Re: newbie question, tshark input from stdin

[Christopher Maynard <Christopher.Maynard () gtech com>]

Evan Huus <eapache@...> writes:

> On Mon, Feb 3, 2014 at 5:43 PM, Christopher Maynard
> <Christopher.Maynard@...> wrote:
> > Evan Huus <eapache <at> ...> writes:
> >
> > > The -i flag is for specifying a network interface for live capture (eg
> > > eth0) and so doesn't accept "-" to signify stdin.
> >
> > The tshark man page[1] would disagree.  I just tested this with 1.10.5 and
> > it worked as documented:
>
> Whoops, yes, you're right, I made a false assumption.

Does anyone know why dumpcap, tshark and Wireshark read from a pipe using
"-i -" and not "-r -"?  It seems more intuitive to me to use "-r" than "-i"
and it would match tcpdump's syntax[1].  I suppose either "-r -" or "-i -"
could be allowed?

- Chris

[1]: http://www.tcpdump.org/tcpdump_man.html


___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe