Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 2039] Triggered Capture

Date: Thu, 10 Apr 2008 20:01:33 +0000 (GMT)
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2039





--- Comment #2 from Jason <wireshark-bugs@xxxxxxxxxxxxxx>  2008-04-10 20:01:26 GMT ---
Created an attachment (id=1663)
 --> (http://bugs.wireshark.org/bugzilla/attachment.cgi?id=1663)
patch [1/3] drop privileges after opening devices

This is the first of three patches I created over the past few days.  

This patch moves the pcap_open_live() functions together and then drops
privileges right after.  This code was borrowed from tcpdump and modified.  

The end goal is to run a program (or script) at a start event and a different
one at a stop event.  This way, you could trigger on a mac address, and launch
tshark with a read filter "-R" for HTTP POST's or some such.  

These patches are in _no_ way final.  It compiles for me (on linux) and runs,
please check me.  ;-)


-- 
Configure bugmail: http://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.