Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I think what I want to do is very easy, but I can not find a way to do that:

If I put this command:

[root@:Active] tmp # tcpdump -i any -s 65535 host 192.168.1.110 and port 1645 or port 1813 -v
-X | grep -o 'Start'
Start
Start
...
...
...
Start
Start
10047 packets captured
10046 packets received by filter
0 packets dropped by kernel

I got a lot of Start coincidence, but I only want to count how many "Start" is actually showing in the shell (meanwhile the tcpdump command is running).

I try adding wc -l:

[root@:Active] tmp # tcpdump -i any -s 65535 host 192.168.1.110 and port 1645 or port 1813 -v
-X | grep -o 'Start' | wc -l
tcpdump: listening on any, link-type EN10MB (Ethernet), capture size 65535 bytes

But still nothing, I don't want to save a file with the output of tcpdump and then count, just count the output lines that already is showing, in real time.

Also I try some combination with xargs, but still fail counting. I think "wc -l" "grep -c" and similar commands needs a file to point and count, but I don't know where in the memory the output from tcpdump is storage.

If you have any clever ideas will be appreciate it :D.

I still think that I'm missing some silly things, the lines already are showing in the shell, I just need to count how many are they, without saving any file or stopping the tcpdump.

Meanwhile I will keep trying, some friend told me with AWK language I can do this.

Greetings to all.

share|improve this question

1 Answer 1

up vote 4 down vote accepted

You seem to want the count instead of the 'Start' output.

Display count instead:

tcpdump -i any -s 65535 host 192.168.1.110 and port 1645 or port 1813 -v -X |
  awk '/Start/ {c++;print c} {}'

Display count and line:

tcpdump -i any -s 65535 host 192.168.1.110 and port 1645 or port 1813 -v -X |
  awk '/Start/ {c++; print c, $0} {}'

Display count on the same line:

tcpdump -i any -s 65535 host 192.168.1.110 and port 1645 or port 1813 -v -X |
  awk '/Start/ {c++; printf "\r%d", c} {} END {print}'
share|improve this answer
    
Hello @Arcege, Happy New Year!!!, thanks for your reply, you get what I wanted to do, thanks... Now I will continue learning more AWK –  Carlos Jan 2 '12 at 19:03
    
The Last command you put "Display Count on the same line" Was the original idea that I tried with the grep modification. Now this question can be closed or solve, but I dont know if the administrator or me should do this. –  Carlos Jan 2 '12 at 19:07
    
You mark the appropriate answer as the one with the solution. There is a grey checkmark next to each answer; click on the checkmark for the answer which you feel is the best solution. On the main page, the question will be marked differently indicating that you accepted an answer. "Closed" is for when the question is not appropriate for this site. –  Arcege Jan 2 '12 at 19:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.