Re: [Wireshark-dev] How to stop extcap gracefully

2021-11-27 Thread Roland Knall
In the case of ciscodump, there is no closing on the extcap side. Basically it reads packets indefinitely in ssh_loop_read, until you either have a read error on the channel, or you got the end packet. You would need to add another exit condition to the do..while loop there. extcap programs work

Re: [Wireshark-dev] How to stop extcap gracefully

2021-11-27 Thread Jirka Novak
Hi Roland, > Due to the nature of extcaps, they are not explicitly closed. Instead, > you should monitor the created pipes. Dumpcap closes those pipes when > the capture has finished. We do send them a kill signal, but due to the > nature of the signal handling, this signal may be missed. > >

Re: [Wireshark-dev] How to stop extcap gracefully

2021-11-27 Thread Roland Knall
Due to the nature of extcaps, they are not explicitly closed. Instead, you should monitor the created pipes. Dumpcap closes those pipes when the capture has finished. We do send them a kill signal, but due to the nature of the signal handling, this signal may be missed. The sure fire way is, if

[Wireshark-dev] How to stop extcap gracefully

2021-11-27 Thread Jirka Novak
Hi, I'm working on ciscodump extcap. The the application creates settings on Cisco device and when it ends, it clears settings. The issue is that when capture is stopped during capture, the application is stopped and settings stays on Cisco device. I added signal handling to ciscodump so