If -U is specified, flush the file after creating it, so it's not zero-length.

Reading from a capture file that has not yet received any packets fails
with "truncated dump file"; to avoid this, flush the file (forcing the
pcap header out) immediately after opening it.

(Added Romain to the credits.)

Reviewed-By: Guy Harris <guy@alum.mit.edu>

2 files changed, 5 insertions, 0 deletions

diff --git a/CREDITS b/CREDITS
index a89a2f1d..e75b65f2 100644
--- a/CREDITS
+++ b/CREDITS
@@ -155,6 +155,7 @@ Additional people who have contributed patches:
 	Rob Braun			<bbraun at synack dot net>
 	Robert Edmonds			<stu-42 at sourceforge dot net>
 	Roderick Schertler		<roderick at argon dot org>
+	Romain Francoise		<rfrancoise at debian dot org>
 	Sagun Shakya			<sagun dot shakya at sun dot com>
 	Sami Farin			<safari at iki dot fi>
 	Scott Rose			<syberpunk at users dot sourceforge dot net>
diff --git a/tcpdump.c b/tcpdump.c
index b26188f5..2f120396 100644
--- a/tcpdump.c
+++ b/tcpdump.c
@@ -1212,6 +1212,10 @@ main(int argc, char **argv)
 			callback = dump_packet;
 			pcap_userdata = (u_char *)p;
 		}
+#ifdef HAVE_PCAP_DUMP_FLUSH
+		if (Uflag)
+			pcap_dump_flush(p);
+#endif
 	} else {
 		type = pcap_datalink(pd);
                 printinfo.ndo_type = 1;