Wireshark · Wireshark-users: Re: [Wireshark-users] newbie question, tshark input from stdin

[Christopher Maynard <Christopher.Maynard@xxxxxxxxx>]

Jaap Keuter <jaap.keuter@...> writes:

> That's probably because -r refers to a file (which you can seek through),
while
> -i refers to a 'stream' (which you cannot seek). Now, tcpdump is single pass
> while *shark has multi pass capability *for files*. Categorizing pipes in
*shark
> as files would open up that multi pass option, which it cannot handle, while
> tcpdump would never do that so it can access a pipe as a file.

What about allowing "-r -", but just treating it exactly the same as if "-i
-" had been specified?