ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Ethereal-dev: Re: [ethereal-dev] Windows Packet Capture routines

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxxxxx>
Date: Thu, 16 Dec 1999 01:25:24 -0800
> How about this function:
> 
> FILE *tmpfile( void );
> 
> Which appears to do it in one operation?  This is an ANSI C function so you
> might be able to use in non-Windows builds too.  The files it creates are
> supposed to be deleted automatically on program exit.  Microsoft also
> supplies a non-standard function _rmtmp() that lets you manually kill the
> temp files at a time of your choosing.
> 
> It doesn't give you control over the name like mkstemp, would that be an
> issue? 

It might be.

In fact, the file has no name; from the FreeBSD man page (but it should
be the same on other systems):

     The tmpfile() function returns a pointer to a stream associated with a
     file descriptor returned by the routine mkstemp(3).  The created file is
     unlinked before tmpfile() returns, causing the file to be automatically
     deleted when the last reference to it is closed.  The file is opened with
     the access value `w+'.

There are currently two clients of "create_tempfile()" (the routine in
Ethereal that uses "mkstemp()"):

	the "follow TCP stream" code - it puts the text from the stream
	in a temporary file;

	the packet capture code.

The former code could possibly be rewritten to seek back to the
beginning of the file, rather than to reopen the file, to reread it.

The latter code might be trickier, as "Save As" on a capture file will
try to move or copy the temporary file if you're saving it in the
format in which it's written - the "copy" part could be done by reading
the file, but the "move" part would, obviously, be impossible (unless
your OS lets you turn a nameless file into a file with a name; no UNIX
system I know of lets you do that).