KillMode=mixed so shutdown finalises captures cleanly; dumpcap -F pcapng; fix installer AP check pattern

internal/capture/engine.go

@@ -349,7 +349,7 @@ func (e *Engine) Start(ctx context.Context, o StartOptions) (Session, error) {
 		return Session{}, err
 	}
 
-	args := []string{"-q", "-n", "-w", "-"}
+	args := []string{"-q", "-F", "pcapng", "-w", "-"}
 	for _, i := range o.Interfaces {
 		args = append(args, "-i", i)
 		if o.CaptureFilter != "" {

scripts/install.sh

@@ -154,7 +154,7 @@ apt-get install -y -qq --no-install-recommends tshark wireshark-common nftables
 dpkg-reconfigure -f noninteractive wireshark-common >>"$LOG" 2>&1 || true
 
 if [ -n "$WIFI" ]; then
-  /usr/sbin/iw list 2>/dev/null | awk '/Supported interface modes/{f=1;next} f&&/^\t\t\*/{print} f&&!/^\t\t\*/{f=0}' | grep -q '\* AP$' \
+  /usr/sbin/iw list 2>/dev/null | grep -A15 'Supported interface modes' | grep -Eq '^[[:space:]]+\* AP$' \
     && echo "    Wi-Fi radio supports AP mode" || warn "Wi-Fi radio does not report AP mode support: the access point may not start"
 fi
 /usr/sbin/getcap /usr/bin/dumpcap | grep -q cap_net_raw || die "dumpcap has no capture capabilities after install (getcap /usr/bin/dumpcap)"

systemd/pilens.service

@@ -18,6 +18,9 @@ WatchdogSec=60
 # Shutdown stops any running capture and hashes its last segment.
 TimeoutStopSec=60
 KillSignal=SIGTERM
+# Only the main process gets SIGTERM; it stops dumpcap itself so the capture
+# is finalised as "stopped" rather than seeing dumpcap die underneath it.
+KillMode=mixed
 StateDirectory=pilens
 StateDirectoryMode=0750
 UMask=0027