Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] tshark now using dumpcap - unix side currently don't work -

From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Thu, 27 Sep 2007 12:04:13 -0400


Ulf Lamping wrote:
Where I'm now lacking knowledge of is the best way to implement the pipe related stuff for the unix side - I need some help here. The current implementation uses a dummy function which runs into a g_assert(), therefore the buildbot test step and thark capturing fails now :-(

The problem here is how to read from the pipe that transfers messages from dumpcap to tshark (messages like: "10 new packets arrived"). The actual message handling is no big deal, the problem is to read mechansim (block/poll) on the pipes file descriptor.

The unix specific implementation in Wireshark (gtk/gui_utils.c) uses gtk_input_add_full(), but as we don't want to include GTK/GDK with tshark, we need a different way to handle this. The Win32 implementation that I've done in tshark.c uses 200ms polling and Win32 specific PeekNamedPipe/GetExitCodeProcess and GStaticMutex to deal with this - this is basically the same implementation as in Wiresharks gui_utils.c (except for the mutex, which is new to prevent reentrance problems due to changed timer mechanism).

So what we need now is something like this on the unix side. tshark.c line 1682 contains already a function pipe_timer_cb() that will be called every 200ms and currently only contains a g_assert() - but this is only a thought. Would a select() call on the pipe_input.source file descriptor do the trick here?

Could someone with more knowledge about this stuff could have a look at this?

First, thanks for doing it! :-)

Second: I don't know much about it but I just committed something that works for me.

It seems (based on my somewhat limited testing) that we don't need to worry about blocking in tshark so the *NIX side is now just blocking trying to read from the child. Could the Windows side not do the same?

Could other *NIX users test tshark to see if it works (I'll see in a while if the buildbots are happy about it)?