Wireshark-dev: Re: [Wireshark-dev] How does dumpcap.c communicate linktype when pushing packets
From: Jeff Morriss <[email protected]>
Date: Thu, 10 May 2012 17:06:36 -0400
Richard Sharpe wrote:
> Hi folks,
> The problem with my changes to support pcap-ng through pipes seems to
> be that I am not communicating linktype correctly.
> What is the secret?

IIRC Wireshark gets the linktype of the interfaces BEFORE the capture
starts.  But I never actually worked in this area.