If -U is specified, flush the file after creating it, so it's not zero-length.

Reading from a capture file that has not yet received any packets fails
with "truncated dump file"; to avoid this, flush the file (forcing the
pcap header out) immediately after opening it.

(Added Romain to the credits.)

Reviewed-By: Guy Harris <guy@alum.mit.edu>

1 files changed, 4 insertions, 0 deletions

diff --git a/tcpdump.c b/tcpdump.c
index b26188f5..2f120396 100644
--- a/tcpdump.c
+++ b/tcpdump.c
@@ -1212,6 +1212,10 @@ main(int argc, char **argv)
 			callback = dump_packet;
 			pcap_userdata = (u_char *)p;
 		}
+#ifdef HAVE_PCAP_DUMP_FLUSH
+		if (Uflag)
+			pcap_dump_flush(p);
+#endif
 	} else {
 		type = pcap_datalink(pd);
                 printinfo.ndo_type = 1;