On Mar 3, 2009, at 11:06 AM, Guy Harris wrote:
Look at the source of the "dumpcap" program in Wireshark for an example of how to do the capture side of that. The secret is that it doesn't just write to the file and not communicate with the program on whose behalf it's capturing - every time it writes N packets to the file, it sends to Wireshark (or TShark) a message over a pipe indicating that it's written N more packets.
...and it also does an fflush() on the standard I/O stream after writing those packets out, so they're actually in the file rather than in the standard I/O stream buffer for the file, in dumpcap's address space.
In any case, don't reinvent the wheel, do what Wireshark does in this case; we (the Wireshark developers) have already spent a lot of time on that particular problem (capture program writing to a file cooperating with a GUI program reading from the file).
- This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.