Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Devices in tshark versus dumpcap

From: Gisle Vanem <gvanem@xxxxxxxx>
Date: Sun, 30 Apr 2017 11:36:48 +0200
I wrote:

The is for sure a problem in how lines of text are generated in dumpcap.exe
and how tshark is interpreting them. I'm not even sure the lines have
"\r\n" terminations since from dumpcap.c:
  #ifdef _WIN32
          /* set output pipe to binary mode, to avoid ugly text conversions */
          _setmode(2, O_BINARY);

And in capchild/capture_ifinfo.c:
  raw_list = g_strsplit(data, "\r\n", 0);

That was the problem, Changing this into:
  raw_list = g_strsplit(data, "\n", 0);

things work as normal!


--
--gv