ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Ethereal-dev: Re: [Ethereal-dev] Patch for stopping traces on SIGINT

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 11 Sep 2003 09:36:52 -0700
On Thu, Sep 11, 2003 at 09:40:12AM -0400, Neil Horman wrote:
>     I've created a patch to allow a user to stop a trace with a SIGINT 
> (#18 on the wish list).  Its not implemented to actually use SIGINT
> since gtk registers a handler for that signal that I didn't really want 
> to override,

It does?  That must be GTK+ 2.x; the only references to SIGINT I can see
in the GLib 1.2.10 and GTK+ 1.2.10 source are

	1) a routine in GLib to print the name corresponding to a
	   signal - that doesn't catch the signal;

	2) a routine in the "gxid" *program* (gdk/gxid.c), which is not
	   part of the library.

> but instead it registers signal handlers in gtk for 
> keyboard events and listens for ASCII 0x03 to end the tracing, which 
> from a look and feel standpoint, is the same thing,

It's only the same thing if, when somebody asked for a way to stop a
trace with SIGINT, they meant "stop a trace by typing control-C to the
application" (BTW, control-C is not everybody's interrupt character,
although it's probably the most common one, these days) rather than
"stop a trace *from another program* by sending a SIGINT to the Ethereal
process".

The wishlist item doesn't say which it is, but I suspect, as they said
SIGINT, they might have meant they wanted a way to stop the trace from
another program (see, for example, the mail from the person who wanted
to run Ethereal from a Python script *and* to have the Python script be
able to stop the capture; unfortunately, using signals wouldn't help
him, as they're a UNIXism, but it might still be useful for UNIX users -
they'd need to specify whether they meant "stop a capture and have
Ethereal quit" or "stop a capture and have Ethereal read it in",
although if they meant the former, they might as well use Tethereal or
tcpdump, i.e. if they just want something to capture packets to a file,
and not to have it display the capture, Ethereal is overkill).