On Fri, Jul 12, 2002 at 06:12:49PM -0700, Jaime Fournier wrote: > Just a quick question if it was easy to modify > tethereal to read from STDIN.
Sure, as long as the standard input isn't a pipe. Unfortunately, if it *is* reading from a pipe - whether it's the standard input or not - that won't work, because the library that Ethereal and Tethereal use to read captures does some heuristics on libpcap files to find out which of the various normal or mutant forms of libpcap file it is, and those heuristics involve reading the same part of the file multiple times. > We have some devices on AIX that TCPDUMP can read from > fine, but libpcap does not support. > Would like to be able to read from a pipe. > > Thanks in advance, for any ideas. You'd either have to disable those heuristics when reading from a non-seekable file, or do the "reading the same part of the file multiple times" with some form of internal buffering so that it only has to read the data once from the file.
