Wireshark · Ethereal-dev: Re: [Ethereal-dev] Next steps for privilege separation, some capture engine questions...

["John McDermott" <jjm@xxxxxxxxxx>]

On Tue, 08 Feb 2005 01:30:51 +0100, Ulf Lamping <ulf.lamping@xxxxxx> wrote:

> > To avoid that, perhaps you could have  the client write it to a file in  
> > /tmp (or %TEMP% or whatever) each time it  opens a file.
>
> Write *what* to a tmp file?

I was thinking of writing the full path to the file being opened for  
capture.  That would be very little to write and very quick.
> I would guess it might be the best idea that the child should open and  
> close the capturing files in any case. This scheme must be used IMHO in  
> the ringbuffer case, as the child shouldn't have to wait for the client  
> to open a new (ringbuffer) file when the old is "full".

True.


> Saying this, a simple but working solution might be: The client will  
> pass the (temporary or user's) filename to the client and when the child  
> opens the first/next file, it will send the currently used filename  
> (e.g. the current ringbuffer filename) at that moment to the client.  
> However, I currently don't know the correct marshalling for this, but  
> we'll see.

Oh, that sounds like a good solution: send the filename to the parent when  
the file is *opened*.  That should be fairly uncomplicated.

--john



--
John McDermott, CCP
Writer, Educator, Consultant
jjm@xxxxxxxxxx        www.jkintl.com
V: +1 505/377-6293  F: +1 505/377-6313