0

I want to grep the output of tcpdump and cut some part of it but the command below is not working.

tcpdump ... | grep -i --line-buffered "..." | cut -d'&' -f1,2

Do you know what is the problem? I guess it is because tcpdump produces real time data but I have no idea how solve this problem.

  • & might need escaping – Marcin Mar 8 '16 at 14:15
  • please provide us with one of the tcpdump lines you want parsed and what you put for "..." in your grep search – Bananguin Mar 8 '16 at 14:30
  • Use the -l option with tcpdump. – 123 Mar 8 '16 at 15:46
3

Use the -l option with tcpdump.

-l Make stdout line buffered. Useful if you want to see the data while capturing it. E.g., tcpdump -l | tee dat'' ortcpdump -l > dat & tail -f dat''.

Clearly stated in the man page.

tcpdump -l ... | grep -i "..." | cut -d'&' -f1,2
1

You can pipe the output of tcpdump to a file through a background process and then use tail -F <file> --pid=$! to follow it.

So, something like

tcpdump ... > tcpdump.log 2>&1 &
tail -F tcpdump.log --pid=$! | grep -i --line-buffered "..." | cut -d '&' -f1,2

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.