Hi all, i'm using tshark command and trying some scenarios but something seems to be strange. I modified the Dissectors() function. here is my concern:
And the program went through my code in Dissectors() but it wrote a large tmp file. So, what happens if I remove the tmp file? I tried but nothing happened, the program still print out anything without tmp file. So, how does the program have data to dissect because previously, i ever though dumpcap write data to tmp file then Dissectors() read data from tmp file to dissect but now after removing this file, Dissectors() was still working. if so, why we need a large tmp file while after removing, nothing change? Please correct me if i said something wrong.
When I use option "-w" , nothing went through my code in Dissectors(), so I think if I use "-w", the program only call dumpcap without (or skip) calling Dissectors(), is it right? Other evidence which made me think it could be right is that there is no any value or data print out when I use "-w". Also, we cannot use filter together with "-w", simply because of no Dissector()called if we are using "-w". am I right?
asked 06 Oct '13, 21:54  hoangsonk49 |
One Answer:
If you run with If you want the raw packet data to be written to a file and have the packets dissected, use the If you only want the packets to be dissected, and don't want the raw packet data to be written to a file, don't use the (This is similar to tcpdump, which dissects packets if you don't give it the Currently, tshark writes captured packets to a temporary file in all cases, even if you don't specify answered 06 Oct '13, 23:13  Guy Harris ♦♦ |
Thanks Harris, I understand that we always have a temp file, but I just want to delete it due to disk space because my program run in real and it is non-stop. With the option -P and -W, now i can go through the Dissectors and also able to auto delete the temp file. Thanks for your comment. But i just wonder why tshark needs a temp file? I tried to remove temp file and see nothing happened with tshark.
Because there needs to be some way for dumpcap to supply it with packets, and because the protocol between dumpcap and tshark would need to be different if it were supplying it with packets over a pipe rather than in a file, and we haven't gotten around to making that work yet.
If this is on UN*X (Linux, OS X, *BSD, Solaris, etc.), then removing a file that some process has open just removes its name from a directory; the file doesn't disappear until the last file that has it open closes it, and both dumpcap and tcpdump have it open. It still takes up space while it's still around.