Wireshark · Wireshark-dev: Re: [Wireshark-dev] tshark now using dumpcap - unix side currently don't work - need some help on th

[Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>]

Ulf Lamping wrote:
> Where I'm now lacking knowledge of is the best way to implement the pipe 
> related stuff for the unix side - I need some help here. The current 
> implementation uses a dummy function which runs into a g_assert(), 
> therefore the buildbot test step and thark capturing fails now :-(
>
> The problem here is how to read from the pipe that transfers messages 
> from dumpcap to tshark (messages like: "10 new packets arrived"). The 
> actual message handling is no big deal, the problem is to read mechansim 
> (block/poll) on the pipes file descriptor.
>
> The unix specific implementation in Wireshark (gtk/gui_utils.c) uses 
> gtk_input_add_full(), but as we don't want to include GTK/GDK with 
> tshark, we need a different way to handle this.
> The Win32 implementation that I've done in tshark.c uses 200ms polling 
> and Win32 specific PeekNamedPipe/GetExitCodeProcess and GStaticMutex to 
> deal with this - this is basically the same implementation as in 
> Wiresharks gui_utils.c (except for the mutex, which is new to prevent 
> reentrance problems due to changed timer mechanism).
>
> So what we need now is something like this on the unix side. tshark.c 
> line 1682 contains already a function pipe_timer_cb() that will be 
> called every 200ms and currently only contains a g_assert() - but this 
> is only a thought. Would a select() call on the pipe_input.source file 
> descriptor do the trick here?
>
> Could someone with more knowledge about this stuff could have a look at 
> this?

First, thanks for doing it! :-)

Second: I don't know much about it but I just committed something that 
works for me.

It seems (based on my somewhat limited testing) that we don't need to 
worry about blocking in tshark so the *NIX side is now just blocking 
trying to read from the child.  Could the Windows side not do the same?

Could other *NIX users test tshark to see if it works (I'll see in a 
while if the buildbots are happy about it)?