For some reason tshark is buffering

README.md

The idea is that the joiner will run as a master daemon, watching tshark and the processor which here is represented by std-reader. If either process is to die, the daemon will restart and re-join the FDs; this isn't implemented yet, but would be the end goal.

joiner

#!/usr/bin/env ruby

def kill_all_children(children, signal)
  children.each{ |wpid| Process.kill(signal, wpid) }
end

worker_pids = {}

[:INT, :QUIT].each do |signal|
  Signal.trap(signal) { kill_all_children worker_pids.values, signal }
end

reader, writer = IO.pipe

interface = ARGV.shift
tshark_cmd = %W[tshark -i #{interface} -R http -T fields -e http.user_agent]

# Neither the Process.spawn nor the direct fork + exec seem to solve the buffer issue
writer.sync = true
worker_pids[:tshark] = Process.spawn *tshark_cmd, out: writer
#fork do
#  reader.close
#  writer.sync = true
#  STDOUT.reopen writer
#  exec *tshark_cmd
#end
writer.close

worker_pids[:processor] = Process.spawn "std-reader", in: reader
reader.close

Process.waitall     # Dumb run loop. Just wait until all children are dead

std-reader

#!/usr/bin/env ruby

$stdin.sync = true
$stdout.sync = true

$stdin.each_line do |line|
  $stdout.puts line
end

So very frustratingly if I change the pipes to use PTY and raw things work 😖 😬

require 'io/console'
require 'pty'

reader, writer = PTY.open
writer.raw!

Ooooor I could just have read the man page more closely and used the -l flag. Thanks @brkane