7

To display content of pcap file , we use :

tcpdump -r /Path/to/syscontection.pcap;

However, this command line does not follow the pcap file on realtime , like tail -f which follows a plain text .

  • Is there an option with tcpdump which acts like -f of tail ?

OR

  • Is there an option with tail that can read pcap file?

OR

  • Something else ?
3
  • tcpdump acts exactly what you want when running with no parameters. Sep 19, 2016 at 14:28
  • 3
    Possible duplicate of How to process/pipe TCPDUMPs output in realtime. I also recommend checking the man page before asking a question, it might save you some time.
    – Hatclock
    Sep 19, 2016 at 14:30
  • 2
    This is not a duplicate question. He is asking about tcpdump's input not output.
    – rudimeier
    Sep 19, 2016 at 14:49

1 Answer 1

14
tail -c +1 -f /Path/to/syscontection.pcap | tcpdump -l -r -
3
  • This will not work when we want to read from multiple files, what will be the solution for tcpdump -l -r file1,file2 e.g. ? tail -c +1 -f file1 -f file2 | tcpdump -l -r - will not work since tail will output some extra lines while tailing multiple files
    – Dipto
    Apr 9, 2021 at 13:14
  • 1
    @Dipto I guess you could simply two or more of these pipe command lines in backround. ( tail -c +1 -f a.pcap | tcpdump -l -r - & tail -c +1 -f b.pcap | tcpdump -l -r - & )
    – rudimeier
    Apr 13, 2021 at 23:08
  • Thanks. But what I found is tcpdump -r /Path/to/pcap is able to follow the file in realtime as it is. May be OP is facing another problem superuser.com/questions/735017/…
    – Dipto
    Apr 16, 2021 at 11:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .