Filtering output of tcpdump and running script when string is found in realtime

Question

I've got this command which displays packets received and sent on port 1700.

tcpdump -AUq port 1700

In the packet there is the string rxpk, but most of the packets don't have it. When the output contains this string I want some script (which flashes a led) to run.

tcpdump -AUq port 1700 | awk '/rxpk/ { print | "/path/to/blink_led 18" }'

But it appears that it only matches the first time an rxpk is found, subsequent occurences wont trigger the { ... }-part

Anybody an idea why? Or even an other approach to run a script when rxpk is received?

Answer 1

The reason that the LED blinks only once is that when you print to a pipe, the pipe remains open, so there is only one invocation of blink_led. If blink_led was to read its stdin for instructions then this wouldn't be a problem. If it fails to read stdin and exits, then awk will exit too.

The conventional way around this is to close() the pipe so the next invocation starts a fresh one:

tcpdump -Alq port 1700 | awk '
  BEGIN { mypipe="/path/to/blink_led 18"; }
  /rxpk/ { print | mypipe; close(mypipe); }'

system() is fine too, as suggested by @heemayl (and probably better if blink_led has no interest in reading stdin at all).

You'll notice I'm using -l instead of -U, -l flushes stdout to avoid pauses if the output you want is waiting in a stdio buffer (-U enables whole packet flushing when you use -w to write to a file).