If -U is specified, flush the file after creating it, so it's not zero-length.

Reading from a capture file that has not yet received any packets fails
with "truncated dump file"; to avoid this, flush the file (forcing the
pcap header out) immediately after opening it.

(Added Romain to the credits.)

Reviewed-By: Guy Harris <[email protected]>

diff --git a/CREDITS b/CREDITS
index 0a3b56eb238f2eafa0525f8e8909db3a0b2b943a..db23984559d33d44a148f439c2cdce3be682d67f 100644 (file)
--- a/CREDITS
+++ b/CREDITS
@@ -154,6 +154,7 @@ Additional people who have contributed patches:
        Rob Braun                       <bbraun at synack dot net>
        Robert Edmonds                  <stu-42 at sourceforge dot net>
        Roderick Schertler              <roderick at argon dot org>
+       Romain Francoise                <rfrancoise at debian dot org>
        Sagun Shakya                    <sagun dot shakya at sun dot com>
        Sami Farin                      <safari at iki dot fi>
        Scott Rose                      <syberpunk at users dot sourceforge dot net>

diff --git a/tcpdump.c b/tcpdump.c
index b42509eb44bde86ae2ccc251d260cf7073324e90..a121d8ba02af451340c84146eaea330285dd4834 100644 (file)
--- a/tcpdump.c
+++ b/tcpdump.c
@@ -1209,6 +1209,10 @@ main(int argc, char **argv)
                        callback = dump_packet;
                        pcap_userdata = (u_char *)p;
                }
+#ifdef HAVE_PCAP_DUMP_FLUSH
+               if (Uflag)
+                       pcap_dump_flush(p);
+#endif
        } else {
                type = pcap_datalink(pd);
                 printinfo.ndo_type = 1;