Read from stdin about termshark

[gcla]

This one's next up for me!

[gcla]

Thanks for the suggestion, I'll take a look at this.

[ZeroChaos-]

I spent a while thinking termshark was broke until I realized it simply doesn't support this and works fine with live interfaces or pcap files :-) 👍 on the feature request

[gcla]

Hi @zerochaos - I just committed an attempt at this. Would you be willing to give it a try? This ought to compile and install the latest termshark:

export GO111MODULE=on
git clone https://github.com/gcla/termshark
cd termshark
go install ./...

Then termshark will be in ~/go/bin/. I'm using go 1.12.1.

It was an intrusive change to the code, so do let me know if anything breaks or acts strangely.

[ZeroChaos-]

read from stdin works, but my mouse stopped working. mouse works in termshark 1.0.0

[gcla]

Thanks for trying it. Broken mouse - my stupid error...

a90e32d

I realized I've also broken the windows build. Fixes for that coming later.

[ZeroChaos-]

works now. can you please add a git tag soon? :-)

I can't do it myself, but this issue is closed (at least on linux)

[gcla]

Thanks :-) Yes, I'm trying to get v1.1.0 ship-shape, but I'm worried it's not very well-tested, and the automated tests are feeble... Hopefully not too much longer!

[geekscrapy]

Was this added? I dont see it in --help

termshark v2.1.1

[gcla]

Hi @geekscrapy - you are right, I didn't update the help, sorry. I'll fix it. Yes, reading from stdin is in v2.2.1, though you need to use the -i flag at the moment. Try

cat foo.pcap | termshark -i -

I thought that

cat foo.pcap | termshark

worked too, but it looks like there's a bug.

[gcla]

Hi @geekscrapy - I made a small update to the master branch and this now works again:

cat foo.pcap | termshark

[geekscrapy]

Awesome (is it in Brew yet?)! Just one thing that might trip users up (it did me), can the stdin option also apply to -r? Seems logical to me as the file isn't an interface, but an already pcaped file. It depends on how closely you are trying to mirror wireshark and not tshark though. tshark can take pcap stdin using both -r and -i, while wireshark only takes -i... Just a consideration! Might want to make this explicit in --help as at the moment it explicitly states "Interfaces" to read from, whereas -r is a "pcap"

[gcla]

Hi @geekscrapy - no, not on Brew yet. I probably need to make another dot release for that. In the meantime, here is a pre-built binary for macOS, if that helps:

https://storage.googleapis.com/termshark/7fa8f260bd01a6d32c679e12258bfa7a50cbe2f6/termshark_darwin_amd64/termshark

Thanks for the flags suggestion! Yes, all these should work:

cat foo.pcap | termshark -r -
cat foo.pcap | termshark -i -
cat foo.pcap | termshark

I just tweaked the handling of flags, do let me know if you run into any combinations that break!