Feature request: Treat pipes as interfaces about termshark

[ZeroChaos-]

wouldn't you use -r mypipe? pipes are files

[pocc]

termshark and tshark are both used in the example above. Can you provide a full counter-example so I can get a better idea of what you're talking about?

[ZeroChaos-]

first establish the pipe and something writing to the pipe. note, tcpdump, tshark, etc are writing to a FILE, that's what a pipe is.

theprophet /tmp # mkfifo mypipe
theprophet /tmp # tcpdump -i eth1 -w mypipe
dropped privs to tcpdump

Then try to read it

zero@theprophet /tmp % tcpdump -i mypipe
tcpdump: mypipe: You don't have permission to capture on that device
(socket: Operation not permitted)
zero@theprophet /tmp % tshark -i mypipe
Capturing on 'mypipe'

Note that tcpdump can't find an interface called mypipe (because one doesn't exist) but tshark seems to have some kind of special handling for pretending a file is an interface, but tcpdump doesn't. tcpdump can read the file just fine

zero@theprophet /tmp % tcpdump -r mypipe
reading from file mypipe, link-type EN10MB (Ethernet)

This odd kind of special handling is confusing for users, and makes for confusion in the code. pipes are files, read them like files. That said, termshark doesn't seem to support reading pipes as files either, so this is still a feature request

[pocc]

Cheers for the writeup. This is more descriptive than my initial post.

[gcla]

I just committed a change for this. I'll mark this as - Duplicate of #9