From Benjamin Tse via bug 2200:

I've created a new bug rather than reopening 1181 as the scope is constrained
somewhat more.

Basically, when capturing from a named pipe the wireshark display lags by one
packet. This is especially frustrating when the packets arrive at low rates.

tshark is fine. But the packet count in dumpcap also lags by one.

Looking at the code, the problem appears to be in cap_pipe_select(). It
attempts to use WaitForSingleObject() on the named pipe but AFAICT this never
blocks.

I've attached a diff for some code that fixes the issue for me. The semantics
of overlapped IO in Win32 is quite different from the select/read model - hence
the other changes!

I've tested this fix on WinXP, 2k server and 2003 server. I've also checked
that my changes compile on a Freespire box that I have lying around.


From me:

Adapt the changes for dumpcap, which is where the affected code now lives.

svn path=/trunk/; revision=28452

1 files changed, 4 insertions, 0 deletions

diff --git a/AUTHORS b/AUTHORS
index 0ec096e0c5..95dd767c3e 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -2851,6 +2851,10 @@ Nick Lewis			<nick.lewis@atltelecom.com> {
 	Show timestamp problems in RTP player
 }
 
+Benjamin Tse			<benjamin_tse@agilent.com> {
+	Overlapped pipe I/O for dumpcap under Windows
+}
+
 and by:
 
 Pavel Roskin            <proski [AT] gnu.org>