Dumpcap Parameter -Z

Question

Can someone tell me what the parameter "-Z" does for dumpcap? I've seen Wireshark calling dumpcap with that parameter, but the integrated help doesn't tell what it means. The complete command line was:

"C:\Program Files\Wireshark\dumpcap" -t -n -i \Device\NPF_{F7CB705F-7A3D-4CBF-B881-1D0074D695D7} -y EN10MB -u -r -i \Device\NPF_{E98CD01D-49F2-412E-A1AD-EE1B89EF3E61} -y EN10MB -u -r -Z 6264

Accepted Answer

From dumpcap.c:

/*
 * Determine if dumpcap is being requested to run in a special
 * capture_child mode by going thru the command line args to see if
 * a -Z is present. (-Z is a hidden option).
 *
 * The primary result of running in capture_child mode is that
 * all messages sent out on stderr are in a special type/len/string
 * format to allow message processing by type.  These messages include
 * error messages if dumpcap fails to start the operation it was
 * requested to do, as well as various "status" messages which are sent
 * when an actual capture is in progress, and a "success" message sent
 * if dumpcap was requested to perform an operation other than a
 * capture.
 *
 * Capture_child mode would normally be requested by a parent process
 * which invokes dumpcap and obtains dumpcap stderr output via a pipe
 * to which dumpcap stderr has been redirected.  It might also have
 * another pipe to obtain dumpcap stdout output; for operations other
 * than a capture, that information is formatted specially for easier
 * parsing by the parent process.
 *
 * Capture_child mode needs to be determined immediately upon
 * startup so that any messages generated by dumpcap in this mode
 * (eg: during initialization) will be formatted properly.
 */

In short, -Z is used when dumpcap is being called from (wire|t)shark to streamline inter-process communication.