Mailing List Archive: error when tethereal reading STDIN as file (-r

Hi again

Now that I have the latest version of (t)ethereal running on my
system I've another question. When I pipe STDOUT of another packet capture
program to STDIN of tethereal it quits running after several packets and
returns to the shell.

For example:

tcpdump -n -w- | tethereal -n -p -r-

OR

tcpdump -n -w- | tcpdpriv -p -q -A99 -C99 -M99 -P99 -r- -w- 2>&/dev/null | \
tethereal -n -p -r- -F ngsniffer -w capture.all.enc

However if I perform the same operation but substitute tcpdump it
continues to function for as long as needed.

tcpdump -n -w- | tcpdpriv -p -q -A99 -C99 -M99 -P99 -r- -w- 2>&/dev/null | \
tcpdump -n -p -r- -w capture.all.pcap

I'm trying to do this in an all in one process to avoid creating an
intermediate file when trying to create a packet capture with no data that
is readable by Distributed Sniffer Pro(tm). This is on an i686 OpenBSD
system.

thanks again,

diana eichert
network systems analyst
org 9314
sandia national laboratories
soccer, softball and volleyball player
(computer nerds need exercise too!)
albuquerque, nm

> Now that I have the latest version of (t)ethereal running on my
> system I've another question. When I pipe STDOUT of another packet capture
> program to STDIN of tethereal

Tethereal doesn't support reading from a pipe; the library that it and
Ethereal uses do a fair bit of seeking (yes, even in single-pass
programs like Tethereal; they seek around in order to figure out what
type of file it is and, in the case of libpcap files, which particular
hellish mutant variant of libpcap it is).

> However if I perform the same operation but substitute tcpdump it
> continues to function for as long as needed.

The library tcpdump uses to read capture files (libpcap) does support
reading from pipes, but doesn't support reading capture files of the
type that require seeking around to determine the type.