2

The pipeline

sudo ngrep -W byline -qilw 'get' tcp dst port 80 | grep -i ".*" |tee /tmp/output

or

sudo ngrep -W byline -qilw 'get' tcp dst port 80 | grep -i ".*" > /tmp/output

will not write anything to /tmp/output when I do an HTTP GET request.

Without redirection I can get some output on standard output. Why?

8
  • what is ngrep -W byline -qilw 'get' tcp dst port 80supposed to do ? – Archemar Nov 13 '16 at 17:45
  • capturing HTTP get request, linux.die.net/man/8/ngrep – rem Nov 13 '16 at 18:23
  • try removing -l (line buffering) option from ngrep – Archemar Nov 13 '16 at 18:31
  • 1
    my understanding of grep -i ".*" is : grep , ignoring case, any char . any number of time * . this grep make no sense to me. (unless filtering fancy display) – Archemar Nov 13 '16 at 18:41
  • 1
    Perhaps it's just a matter of buffering then? have you tried adding --line-buffered to the grep (equivalent of ngrep -l ... )? – steeldriver Nov 14 '16 at 0:54
0

The grep utility will do buffering of its output when it isn't connected to a terminal. You will not see any output in the /tmp/output files until the output buffer of grep has been filled and flushed.

This will only be an issue for as long as ngrep is running. Once ngrep terminates, grep will flush its output buffer before it too terminates.

This buffering is done for performance reasons. Flushing a line of text to the output takes a short amount of time, but when massive amounts of data is involved, this slowes the pipeline down.

You may turn off the buffering that grep does, or rather, enable line-buffering. With BSD and GNU grep, this is done with the non-standard option --line-buffered, so you'll get

sudo ngrep -W byline -qilw get tcp dst port 80 |
grep --line-buffered -i '.*' |
tee /tmp/output

Or, you could just remove that grep completely as it will pass all lines from ngrep on to tee (the regular expression .* matches on every line, no matter if it's empty or not).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.