Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] How code recognizes that processing of all packets with tap

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 13 Jul 2018 02:31:25 -0700
On Jul 13, 2018, at 2:20 AM, Jirka Novak <j.novak@xxxxxxxxxxxx> wrote:

> What is not clear to me what should happen when live capture is running?
> I'm afraid that if I will call "finish" at the end of current live
> capture (and write footer), later received packet will be delivered to
> "packet" callback

If you call "finish" at the *end* of the current live capture, there won't *be* any later received packets.

("End of the current live capture" means "the entire capture is finished", not "we've finished reading the current batch of packets".)