Wireshark-dev: Re: [Wireshark-dev] Windows dumpcap -i [email protected]<IP>
From: James Ko <[email protected]>
Date: Wed, 3 Oct 2018 17:58:54 +0000
Can I petition for this as a fix rather than a feature since the -i [email protected] works in the Linux builds but not in Windows?


From: Wireshark-dev <[email protected]> on behalf of Graham Bloice <[email protected]>
Sent: Wednesday, October 3, 2018 10:38
To: Developer support list for Wireshark
Subject: Re: [Wireshark-dev] Windows dumpcap -i [email protected]<IP>
Ignore my last, I was confusing the change with another.  The Release policy still applies though.
On Wed, 3 Oct 2018 at 18:36, Graham Bloice <[email protected]> wrote:

On Wed, 3 Oct 2018 at 18:31, James Ko <[email protected]> wrote:
Just to follow up.  I created bug #15149 and submitted a fix for review 29894 based on master.

Do I need to create a separate patch if I need this included in the next 2.6.x release?

Arguably this is a feature and so would not be a candidate for backport to 2.6.  See the Release Policy wiki page: https://wiki.wireshark.org/Development/ReleasePolicy

Core devs handle the backport if there is one.

From: James Ko <[email protected]>
Sent: Wednesday, September 19, 2018 00:42
To: Developer support list for Wireshark
Subject: Re: Windows dumpcap -i [email protected]<IP>
Actually wireshark is not running on the Linux side and this is not using rpcap.

I am using the [email protected] sockets stream support built in to dumpcap rather than extcap or rpcap.

On the linux side I have a TCP server which generates PCAPNG data with SHB and IDB sent to any client connecting followed by EPBs.

I have wireshark/dumpcap 2.6.2 on Windows and Linux (Ubuntu 18.04) clients. 


From: Anders Broman
Sent: Tuesday, September 18, 00:27
Subject: Re: [Wireshark-dev] Windows dumpcap -i [email protected]<IP>
To: Developer support list for Wireshark

What version of Wireshark and what Linux version on the remote side? I think some work has ben done on rpcap recently so trying out the development version
From: Wireshark-dev <[email protected]> On Behalf Of James Ko
Sent: den 18 september 2018 02:22
Subject: [Wireshark-dev] Windows dumpcap -i [email protected]<IP>
I am trying to connect to a remote PCAPNG stream from Windows using the [email protected] socket interface but the connection closes immediately after connecting.  The same dumpcap command on linux works just fine to the remote TCP socket.
No errors indicating any failure are printed from dumpcap.exe
C:\>"\Program Files\Wireshark\dumpcap.exe" -i [email protected] -w -
Capturing on '[email protected]'
On the remote end running in linux I see a connect and disconnect with EPOLLHUP event.
Has anyone else tried or have remote TCP socket connections working with dumpcap in Windows?

Graham Bloice

Graham Bloice