On Wed, Jun 07, 2000 at 04:15:44PM -0500, Jim Wildman wrote: > > > On HPUX (due to the libpcap problems) ethereal can't see all of the > packets (or just crashes). It can, however read the output of HP's > nettl command, after you stuff that output into a file. > > So, can ethereal be coaxed into reading packet info from the stdin? Have you traced the crash to libpcap or Ethereal? Any info would be helpful to either group, either us or the folks at www.tcpdump.org. But, no, stdin won't work. Ethereal makes a first pass through a trace file and reads all the frames. That gives you the list of frames in the top pane of the GUI. Each frame's location in the file is remembered. After that, when you click on a frame's row in the GUI list, the file is read in a random-access fashion (ignoring what zlib has to do to go backwards in a trace gzipped file...) to read that packet. So, the random-access reading is incompatible with the stdin stream. > What exactly does the -S option do? That's the "update packets in real time" option that goes along with the -k command-line option. --gilbert
Powered by MHonArc 2.6.10