This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi, I have a shell script which uses tshark to monitor incoming video traffic, created by an ffmpeg process launched from the same script.

I want to capture until another process ends - so ideally until there has been a gap of X seconds since the last packet was captured. I can't find a way to specify this using parameters, but have managed to almost solve it by capturing the tshark pid, then killing it when the process it is monitoring ends.

This is not a problem on the face of it, since I capture the tshark PID at process start. However, when I do this the dumpcap process is often left running forever...

Any ideas how I can kill both tshark and the dumpcap process it has created...?

asked 14 Jun '17, 02:43

dbrb2
11446
accept rate: 0%


Do you need tshark decoding the incoming packets? If not - meaning you're only interested in capturing the packets, not any packet details during capture - you could just run dumpcap instead of tshark from your script and kill it instead directly.

permanent link

answered 14 Jun '17, 02:47

Jasper ♦♦
23.8k551284
accept rate: 18%

While Jasper's answer is the better overall solution I'll try to answer the initial question.

tshark catches both SIGINT and SIGTERM and (tries to) clean up its child process (dumpcap) after catching those signals--so kill <pid of tshark> should work (since kill uses SIGTERM by default).

You mention that it "often" doesn't work which is odd; I tried a few times here (with a fairly old version, no less) and it worked each time. There may be a problem lurking here but unless you're using a different signal (like SIGKILL) you were already killing tshark the "nice" way.

UPDATE

Actually it occurs to me that if you were using a signal other than SIGINT or SIGTERM then that could explain the behavior you were seeing: the SIGKILL would clearly kill tshark without allowing it to clean up dumpcap. Now IFF no more packets were received then dumpcap would hang around doing nothing. As soon as another packet is received, however, dumpcap will try to send a notification to tshark and should then get a SIGPIPE which would kill off dumpcap. (You mentioned that you were killing tshark after a test was completed which could mean "no more packets for a while.")

permanent link

answered 14 Jun '17, 06:42

JeffMorriss ♦
6.2k572
accept rate: 27%

edited 14 Jun '17, 07:24

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×832
×89
×2

question asked: 14 Jun '17, 02:43

question was seen: 2,011 times

last updated: 14 Jun '17, 07:24

p​o​w​e​r​e​d by O​S​Q​A
{"cc_re__cc_re__cc_by_sa_3_0": ["out</a> <span class=\"link-separator\"> |</span> <a href=\"/faq/\" >faq</a> <span class=\"link-separator\"> |</span> <a href=\"/privacy/\" >privacy</a> <span class=\"link-separator\"> |</span> <a href=\"https://bugs.wireshark.org/\" target=\"_blank\">support</a> <span class=\"link-separator\"> |</span> <a href=\"https://bugs.wireshark.org/\" >contact</a> \n    </div>\n  <p>\n        p&#8203;o&#8203;w&#8203;e&#8203;r&#8203;e&#8203;d by &#79;&#8203;&#83;&#8203;&#81;&#8203;&#65;\n  </p>\n</div>\n <div id=\"licenseLogo\">\n  <a rel=\"license\" href=\"http://creativecommons.org/licenses/by-sa/3.0/\">\n            <img src=\"/m/default/media/images/by-sa-88x31.png\" title=\"Creative Commons: Attribution - Share Alike\" alt=\"cc-by-sa\" width=\"88\" height=\"31\" />\n  </a>\n </div>\n\n\n            </div>\n        \n        \n\n        \n            <script data-cfasync=\"false\" src=\"/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js\"></script><script type=\"text/javascript\">\n                var _gaq = _gaq || [];\n                _gaq.push(['_setAccount', 'UA-605389-6']);\n                _gaq.push(['_"]}