tshark errors silently ignored

Author: eprochassonCreated Aug 16, 2024Updated Aug 17, 2024

Hi,

it looks like tshark errors are silently ignored, which leads to other problems down the line. Typically, I got a "Found no signals, are you sure supports monitor mode?" error, first because:

  • I didn't have the right permission to run tshark, which I fixed
  • then, having run some tests in root, the dumpfile used could not be overwritten by non-root user.

In these cases, instead of getting a clear error message from the subprocess, I just got the fairly unhelpful error from the script.

I would suggest the following:

  • show any error from tshark as a warning. Some errors are not a problem (I do get another one, that doesn't seem to hinder the proper flow), so we may not want to abort the process on error.
  • use proper temporary files / directory, to avoid the type of collision I encountered
  • maybe to use logging, to have a simpler way to manage warning / info / debug (=verbose) stuff.

I'm happy to give it a shot and submit a PR, if it's something that is deemed valuable.

Thanks!

Source: schollz/howmanypeoplearearound