Re: How to properly finalize capture in a Wireshark extcap plugin?

[Dario Lombardo <lomato () gmail com>]

Indeed the used signal to terminate the extcap is SIGTERM.
Is your signal handler called? Did you run a debugger to see which signal
is interrupting your code?
Did you try your code on unix?

On Mon, Nov 23, 2020 at 10:31 AM Timmy Brolin <tib () hms se> wrote:

> I am writing a extcap plugin for Wireshark (Windows version). The
> documentation on how Wireshark stops a extcap capture is a bit sketchy, but
> it seems it simply terminates the extcap plugin.
>
> If I run the extcap binary standalone, and stops it with Ctrl+C,
> everything works as expected. The written pcapng file contains all blocks.
> But when Wireshark runs the extcap binary, the last block, the "interface
> statistics block", never shows up in the Wireshark capture.
>
> Is this a bug in Wireshark? Does Wireshark ignore any additional blocks in
> the pcapng fifo after it has sent the signal to kill the extcap binary?
>
> The essential parts of the extcap plugin looks like this:
>
>
>
> static volatile int keepRunning = 1;
>
> void intHandler(int dummy) {
>
>     keepRunning = 0;
>
> }
>
>
>
> int main(int argc, char *argv[])
>
> {
>
>    ... Parse arguments ...
>
>
>
>    fp = fopen (pcOutputFilename, "wb");
>
>    fwrite( &sSHB, sizeof(sSHB), 1, fp ); // write section header block to pcapng file.
>
>    fwrite( &sIDB, sizeof(sIDB), 1, fp ); // write interface description block to pcapng file.
>
>
>
>    signal(SIGINT, intHandler);
>
>    signal(SIGTERM, intHandler);
>
>
>
>    do{
>
>       ... Capture frames and write to fp ...
>
>    }
>
>    while( keepRunning );
>
>
>
>    fwrite( &sISB, sizeof(sISB), 1, fp ); // write interface statistics block to pcapng file.
>
>
>
>    fclose(fp);
>
> }
>
>
>
>
>
>
>
> Regards,
>
> Timmy Brolin
>
>
> ___________________________________________________________________________
> Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
> Archives:    https://www.wireshark.org/lists/wireshark-dev
> Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
>              mailto:wireshark-dev-request () wireshark org
> ?subject=unsubscribe



-- 

Naima is online.

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe