On Feb 4, 2009, at 6:50 PM, Joshua (Shiwei) Zhao wrote:
However, by our previous experience with Ethereal, the "kill"
command can only cleanly stop tshark sometimes. Many other times the
packets were not correctly flushed out.
So this has been improved in Wireshark over Ethereal?
As "Wireshark" is the name that {the program Gerald Combs started} had
starting with the 0.99.2 release, and "Ethereal" is the name that {the
program Gerald Combs started} had prior to the 0.99.2 release:
http://www.wireshark.org/faq.html#q1.2
the question is more correctly stated as
So this has been improved since {whatever pre-0.99.2 release you were
using} of {the program Gerald Combs started}?
The answer is "it might well have".
If, on UN*X, you use the kill command with only a process-ID argument,
or with "-TERM" and a process-ID argument (which means typing 6 more
characters than you need, as the default signal sent by kill is
SIGTERM), or (on most if not all UN*Xes) with the "-15" argument (if
SIGTERM is 15 on your UN*X, as it is on most UN*Xes - that's still 4
more characters than you need type), to terminate tshark, then, if the
packets aren't correctly flushed out, that's a bug, and should be
reported as such. There may have been bugs of that sort that were
fixed at some point after whatever release of Ethereal you were using.
