Skip to content

Zombie process of tshark by livecapture in MAC OS #750

Description

@duronfire

Describe the bug
In MacOS the tshark -i - will spawn a dumpcap session, which will late be a zombie.

To Reproduce
just run tshark -i -

Expected behavior
A clear and concise description of what you expected to happen.

Versions (please complete the following information):

  • OS: MAC OS 26.3
  • pyshark version: master
  • tshark version: TShark (Wireshark) 4.6.4 (v4.6.4-0-g93282876538d).

Compile-time info:
Bit width: 64-bit
Compiler: Clang 14.0.3 (clang-1403.0.22.14.1)
GLib: 2.86.3
With:
+brotli +MaxMind
+Gcrypt 1.11.2 +nghttp2 1.65.0
+GnuTLS 3.8.12 and PKCS#11 +nghttp3 1.9.0
+Kerberos (MIT) +PCRE2 10.45 2025-02-05
+libpcap +Snappy 1.2.2
+libsmi 0.4.8 +xxhash 0.8.3
+libxml2 2.15.1 +zlib 1.2.11
+Lua 5.4.7 +zlib-ng 2.2.4
+LZ4 1.10.0 +Zstandard 1.5.7
Without:
-POSIX capabilities

Runtime info:
OS: macOS 26.3, build 25D125 (Darwin 25.3.0)
CPU: Apple M5
Memory: 32768 MB of physical memory
GLib: 2.86.3
Locale: LC_TYPE=de_CH.UTF-8
Plugins: supported, 0 loaded
With:
+brotli 1.2.0 +libsmi 0.4.8 +xxhash 803
+c-ares 1.34.6 +LZ4 1.10.0 +zlib 1.2.12
+Gcrypt 1.11.2 +nghttp2 1.65.0 +Zstandard 1.5.7
+GnuTLS 3.8.12 +nghttp3 1.9.0
+libpcap 1.10.1 +PCRE2 10.45 2025-02-05

Fix is simple use "-r -" instead of "-i -" in LiveCapture.py

Metadata

Metadata

Assignees

No one assigned

    Labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions