From 43cbcc407667c9d1493f9c833d18199341b2ac1c Mon Sep 17 00:00:00 2001
From: Andy Dixon <andy@andydixon.com>
Date: Fri, 9 Oct 2026 18:19:09 +0100
Subject: [PATCH] KillMode=mixed so shutdown finalises captures cleanly;
 dumpcap -F pcapng; fix installer AP check pattern

---
 internal/capture/engine.go | 2 +-
 scripts/install.sh         | 2 +-
 systemd/pilens.service     | 3 +++
 3 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/internal/capture/engine.go b/internal/capture/engine.go
index 6ac4ff6..7579afc 100644
--- a/internal/capture/engine.go
+++ b/internal/capture/engine.go
@@ -349,7 +349,7 @@ func (e *Engine) Start(ctx context.Context, o StartOptions) (Session, error) {
 		return Session{}, err
 	}
 
-	args := []string{"-q", "-n", "-w", "-"}
+	args := []string{"-q", "-F", "pcapng", "-w", "-"}
 	for _, i := range o.Interfaces {
 		args = append(args, "-i", i)
 		if o.CaptureFilter != "" {
diff --git a/scripts/install.sh b/scripts/install.sh
index 1ddbeff..0403205 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -154,7 +154,7 @@ apt-get install -y -qq --no-install-recommends tshark wireshark-common nftables
 dpkg-reconfigure -f noninteractive wireshark-common >>"$LOG" 2>&1 || true
 
 if [ -n "$WIFI" ]; then
-  /usr/sbin/iw list 2>/dev/null | awk '/Supported interface modes/{f=1;next} f&&/^\t\t\*/{print} f&&!/^\t\t\*/{f=0}' | grep -q '\* AP$' \
+  /usr/sbin/iw list 2>/dev/null | grep -A15 'Supported interface modes' | grep -Eq '^[[:space:]]+\* AP$' \
     && echo "    Wi-Fi radio supports AP mode" || warn "Wi-Fi radio does not report AP mode support: the access point may not start"
 fi
 /usr/sbin/getcap /usr/bin/dumpcap | grep -q cap_net_raw || die "dumpcap has no capture capabilities after install (getcap /usr/bin/dumpcap)"
diff --git a/systemd/pilens.service b/systemd/pilens.service
index f9274a8..f9099a8 100644
--- a/systemd/pilens.service
+++ b/systemd/pilens.service
@@ -18,6 +18,9 @@ WatchdogSec=60
 # Shutdown stops any running capture and hashes its last segment.
 TimeoutStopSec=60
 KillSignal=SIGTERM
+# Only the main process gets SIGTERM; it stops dumpcap itself so the capture
+# is finalised as "stopped" rather than seeing dumpcap die underneath it.
+KillMode=mixed
 StateDirectory=pilens
 StateDirectoryMode=0750
 UMask=0027