Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] Can ethereal read from a capture file that itself is conti

From: Jeff Morriss <jeff.morriss@xxxxxxxxxxx>
Date: Fri, 06 Oct 2006 08:56:54 +0800


Keith Fleming wrote:
We have an SS7 monitoring tool that is able to write out to stdout raw SS7 MTP3 data. I already have a tool that will convert this to PCAP format. Is it possible to setup ethereal to read from a PCAP file, that is itself being written to?

No, it can't. Well, it can read the file, but it won't pick up the data being appended until you reload the file.

Or is there an easy way to make a �dummy� interface for ethereal to capture from, fooling it into thinking that it is reading from a network interface?

Wireshark can (at least on UNIX) read from pipes or named pipes, that might suit your need.