Wireshark · Ethereal-users: Re: [Ethereal-users] Getting Tethereal to read from a pipe

[Guy Harris <gharris@xxxxxxxxx>]

On Tue, Jul 03, 2001 at 03:31:22PM -0400, Vincas Ciziunas wrote:
>   Could someone tell me what the difference between tethereal and ethereal
> is regarding opening a datafile as a pipe?

There is no difference; the code they use to read capture files does not
support reading from a pipe.

> I really want tethereal to read a pcap-style pipe.

Then you will have to modify all the modules in that library (in the
"wiretap" source directory) that seek backwards in the file in order to
perform various heuristics - heuristics required, for example, to
determine which one of the N different libpcap formats people have
created *without* bothering to give them all different magic numbers or
version numbers, sigh - to, instead, do their own buffering so that they
can look backwards in the data stream without actually doing an
"fseek()" on the stream, as there's no guarantee that "fseek()" works on
pipes.

Then you'll need to remove the test that currently rejects attempts to
open pipes.