On Nov 19, 2020, at 9:07 PM, Alastair Scott <ads@xxxxxxxxxx> wrote:
> Do you know where in the code base I could look for a potential remedy to this issue? I'm trying to find a place to add a delay to ensure the read does not come early.
What needs to be delayed is the sending of the SP_FILE message from dumpcap to TShark/Wireshark when in "pcapng passthrough" mode. See merge request !977:
https://gitlab.com/wireshark/wireshark/-/merge_requests/977
which does exactly that, and my comment in issue #17013:
https://gitlab.com/wireshark/wireshark/-/issues/17013#note_451496651
