Wireshark · Ethereal-users: Re: [Ethereal-users] Tethereal can, Ethereal cannot

[Guy Harris <gharris@xxxxxxxxx>]

Ulf Lamping wrote:

> I'll take a look on my debian box, so could someone explain (or point
> me to info) how to use the pipe "mode"

Create the FIFO file with

	mkfifo /tmp/pipe

(really old UN*Xes might require "mknod p /tmp/pipe", but I don't know 
whether there are any interesting UN*Xes left that don't have "mkfifo").

Start up Ethereal capturing from a "device" named "/tmp/pipe".

Start up some process that writes a libpcap-format file (e.g., tcpdump 
writing to the file with "-w"), and have it write to "/tmp/pipe".

> Is this all about reading from a pipe, capturing from a pipe or even both?

It's about capturing from a pipe; we don't currently support reading 
from a pipe (Wiretap requires the ability to re-read input, so it can 
try reading the file as multiple file types; doing our own buffering 
might let us "seek backwards" by re-reading the buffered data).