From Ronald W. Henderson:

dumpcap should terminate if exactly the maximum number of packets have been captured 
(or greater) as specified by the user: "-c <capture packet count>". The current behavior 
waits until an additional packet is captured until this threshold check occurs.

svn path=/trunk/; revision=27208

1 files changed, 7 insertions, 8 deletions

diff --git a/dumpcap.c b/dumpcap.c
index 11ada789e6..f774490c6c 100644
--- a/dumpcap.c
+++ b/dumpcap.c
@@ -2297,13 +2297,6 @@ capture_loop_packet_cb(u_char *user, const struct pcap_pkthdr *phdr,
   loop_data *ld = (void *) user;
   int err;
 
-  /* if the user told us to stop after x packets, do we already have enough? */
-  if ((ld->packet_max > 0) && (ld->packet_count >= ld->packet_max))
-  {
-     ld->go = FALSE;
-     return;
-  }
-
   /* We may be called multiple times from pcap_dispatch(); if we've set
      the "stop capturing" flag, ignore this packet, as we're not
      supposed to be saving any more packets. */
@@ -2317,8 +2310,14 @@ capture_loop_packet_cb(u_char *user, const struct pcap_pkthdr *phdr,
     if (!libpcap_write_packet(ld->pdh, phdr, pd, &ld->bytes_written, &err)) {
       ld->go = FALSE;
       ld->err = err;
-    } else
+    } else {
       ld->packet_count++;
+      /* if the user told us to stop after x packets, do we already have enough? */
+      if ((ld->packet_max > 0) && (ld->packet_count >= ld->packet_max))
+      {
+        ld->go = FALSE;
+      }
+    }
   }
 }