Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 5516] Server 2008: tshark -i - doesn't work like it does o

Date: Fri, 24 Dec 2010 01:03:44 -0800 (PST)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5516

--- Comment #4 from Guy Harris <guy@xxxxxxxxxxxx> 2010-12-24 01:03:40 PST ---
The reason why -i currently requires *pcap, even if you hand it a named pipe
name or "-", is that the first thing it tries with the argument to -i is to
hand it to pcap_open_live(), pcap_open(), or pcap_create() and pcap_activate()
- i.e., it tries to open it as a networking device.  Only if that fails does it
try opening it as a file or named pipe.

The reason for this is that, in general, there's no way to distinguish between
the name of a named pipe and the name of a network capture device.  However:

    1) "-" is unlikely to be the name of a network capture device on any OS I
know of, so for "-" we might as well skip the "try to open it as a capture
device" step

and

    2) we could, conceivably, skip the "try to open it as a capture device"
step if we don't have *pcap.

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.