Hello Y,
All file descriptors are closed and flushed by UNIX when the
program exits. It should be done by tcpdump/pcap but most people let of
the UNIX system to do it.
Joe.
--
__o _~o __o
`\<, `\<, `\<,
______________________________________(*)/_(*)__(*)/_(*)__(*)/_(*)________
Im a 21st Century Digital Boy ... I aint got a life, but I got lotsa toys.
******************* Joe Elliott [EMAIL PROTECTED] ********************
Phone:(650)961-6631 Cell:(650)714-3932 Inetd.Com http://inetd.com
--------------------------------------------------------------------------
On Thu, 18 Jul 2002, Y Sreenivasulu wrote:
> Date: Thu, 18 Jul 2002 20:05:23 +0530
> From: Y Sreenivasulu <[EMAIL PROTECTED]>
> To: "'[EMAIL PROTECTED]'" <[EMAIL PROTECTED]>
> Subject: [tcpdump-workers] Missing pcap_close and pcap_dump_close in
> tcpdump.c
>
> Hi,
> I am using tcpdump version 3.7.1 on Redhat linux 7.0 kernel version 2.4.5.
> In the source code of tcpdump , there is a situation where
> pcap_loop is being used to capture packets and save them to a savefile.
> If we give '-1' as count to it, it will capture infinitely until interrupted. When
> the program is exited by pressing CTRL+C, the control is going to 'cleanup'
> function. But I wonder there is no pcap_close or pcap_dump_close in the
> 'cleanup' function corresponding to previous pcap_open_live and
> pcap_dump_open. But still savefile is being closed properly and packets
> can be read from it later using tcpdump -r option. How is this possible?
> How are the pcap_dump_close and pcap_close called from 'cleanup' and from where ?
>
>
> Regards,
> Y Sreenivasulu
> [EMAIL PROTECTED]
>
>
> -
> This is the TCPDUMP workers list. It is archived at
> http://www.tcpdump.org/lists/workers/index.html
> To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
>
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
