Wireshark · Wireshark-users: Re: [Wireshark-users] Can ethereal read from a capture file that itself is continuing to grow?

[Jeff Morriss <jeff.morriss@xxxxxxxxxxx>]

Keith Fleming wrote:
> We have an SS7 monitoring tool that is able to write out to stdout raw 
> SS7 MTP3 data. I already have a tool that will convert this to PCAP 
> format. Is it possible to setup ethereal to read from a PCAP file, that 
> is itself being written to?

No, it can't.  Well, it can read the file, but it won't pick up the data 
being appended until you reload the file.

> Or is there an easy way to make a “dummy” interface for ethereal to 
> capture from, fooling it into thinking that it is reading from a network 
> interface?

Wireshark can (at least on UNIX) read from pipes or named pipes, that 
might suit your need.