Wireshark-users: Re: [Wireshark-users] Various instances of wireshark reading from various named pipes

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 3 Oct 2006 15:12:15 -0700

On Oct 3, 2006, at 3:30 AM, Janssens, Kitty wrote:

Could this be a bug ?

Possibly, but it might be a bug in your program.  As I said in the bug:

Are you absolutely certain that *no* process is holding pipe A open? Does your program, for example, fork and exec (or otherwise spawn) other programs while

it holds pipe A open?

If so, *those* processes might be holding the pipe open, even if your program

isn't.

(Note that unlinking the pipe makes no difference; if you unlink a file on a UN*X and some process on the same machine has the file open, the link goes away immediately but the file itself doesn't go away until the last open of the file

is closed.)

The only way in which one instance of Wireshark can be prevented from stopping its capture by another instance of Wireshark would be if one of those instances happened (perhaps by virtue of being run from your program, for example) to have an open file descriptor for the write side of the other instances's input pipe - the write side won't be closed until your program *and* that instance of Wireshark close it, and, as that instance of Wireshark doesn't even know it *has* an open file descriptor for the pipe if it inherited it from the parent

process, it's unlikely to close it until it exits.