On Nov 19, 2020, at 9:07 PM, Alastair Scott <a...@exegin.com> wrote:
> Do you know where in the code base I could look for a potential remedy to
> this issue? I'm trying to find a place to add a delay to ensure the read does
> not come early.
What needs to be delayed is the sending of the SP_FILE message from dumpcap to
TShark/Wireshark when in "pcapng passthrough" mode. See merge request !977:
https://gitlab.com/wireshark/wireshark/-/merge_requests/977
which does exactly that, and my comment in issue #17013:
https://gitlab.com/wireshark/wireshark/-/issues/17013#note_451496651
___________________________________________________________________________
Sent via: Wireshark-dev mailing list <wireshark-dev@wireshark.org>
Archives: https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
mailto:wireshark-dev-requ...@wireshark.org?subject=unsubscribe
