Project

General

Profile

Actions

Feature #1952

closed

allow pcap reading from stdin

Added by Duane Howard over 7 years ago. Updated over 6 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Target version:
-
Effort:
Difficulty:
Label:

Description

It would be really nice to be able to allow reading pcaps from stdin, this would avoid the need to be able to make the open() syscall for arbitrary files (which is required for socket command read now)

Actions #1

Updated by Victor Julien about 7 years ago

  • Assignee set to Anonymous
  • Target version set to TBD
Actions #2

Updated by Anthony Verez over 6 years ago

Hey there, I'm working with Duane. We found a way to work around this for our usage. Feel free to close the issue if nobody else is requesting this. Thanks!

Actions #3

Updated by Victor Julien over 6 years ago

As I think it could be useful for others I'll leave it open.

Actions #4

Updated by Jason Ish over 6 years ago

I think this can be closed. "-r -" or "-r /dev/stdin" seem to work fine for reading pcaps off stdin.

Tools like pcapdj or mergecap can be used to stream multiple pcaps over stdin.

Actions #5

Updated by Victor Julien over 6 years ago

  • Status changed from New to Closed
  • Assignee deleted (Anonymous)
  • Target version deleted (TBD)
Actions

Also available in: Atom PDF