Got a program writing to a pcap that you want to see in real time in Wireshark?

If you can control the output pcap file name, you can swap it out with a fifo so the program writes to that, then open with Wireshark like so:

$ mkfifo /tmp/fifo
$ wireshark -i /tmp/fifo -k

If you have a program that sends packets to stdout, you can pipe them into Wireshark like this to see them as they are being received:

$ ./my_capturing_program.bin | wireshark -k -i -

Both are useful if you are working with userland program that generates packets (such as a sniffer) or something like gnuradio that has a File Sink for output to Wireshark
@netspooky can't you also use /dev/stdout for the file output?
@netspooky Also very handy to capture from a remote host like a router: `ssh host tcpdump -Uw - ... | wireshark -i -`