Wireshark-dev: Re: [Wireshark-dev] explicitly stop capture with Tshark

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 4 Feb 2009 19:01:26 -0800

On Feb 4, 2009, at 6:50 PM, Joshua (Shiwei) Zhao wrote:

However, by our previous experience with Ethereal, the "kill" command can only cleanly stop tshark sometimes. Many other times the packets were not correctly flushed out.

So this has been improved in Wireshark over Ethereal?

As "Wireshark" is the name that {the program Gerald Combs started} had starting with the 0.99.2 release, and "Ethereal" is the name that {the program Gerald Combs started} had prior to the 0.99.2 release:

	http://www.wireshark.org/faq.html#q1.2

the question is more correctly stated as

So this has been improved since {whatever pre-0.99.2 release you were using} of {the program Gerald Combs started}?

The answer is "it might well have".

If, on UN*X, you use the kill command with only a process-ID argument, or with "-TERM" and a process-ID argument (which means typing 6 more characters than you need, as the default signal sent by kill is SIGTERM), or (on most if not all UN*Xes) with the "-15" argument (if SIGTERM is 15 on your UN*X, as it is on most UN*Xes - that's still 4 more characters than you need type), to terminate tshark, then, if the packets aren't correctly flushed out, that's a bug, and should be reported as such. There may have been bugs of that sort that were fixed at some point after whatever release of Ethereal you were using.