I would like to maintain a file which contains the number of seconds since a packet matching a tcpdump filter has been seen. The aim is to work out when a chatty client is no longer on the network. When I stop seeing MDNS junk, I'm pretty sure it's gone.

sudo tcpdump -l -tttt -i wlan0 port 5353 and src <hostname> | cut -c -19 | xargs -0 -n1 ./timesec.sh

Is what I've got so far. timesec.sh will use the input argument in a date -d to compare to a stored date from a file and then update the number of seconds file.

However it's not working, and I suspect that the output from cut is not piping as I expect.

  • The best way to get help on these things is to show us the expected data. Without that, it is hard to give good advice without detailed knowledge of mdns and the tcpdump format for same. Apr 2, 2017 at 5:50
  • Essentially it'll return some decoded packets (doesn't even matter what type), and they'll always start with a timestamp such as: 2017-04-02 22:11:54.588340 I need to cut those 19 chars off the front of each line and use them in a date command so that I can get it in seconds to subtract from a previous date. So packet matching filter seen at T and packet matching filter seen at T2.
    – JonFitt
    Apr 2, 2017 at 22:12
  • quick way to test the pipe into xargs is to turn the command into an echo. So try ...cut -c -19 | xargs -0 -n1 echo ./timesec.sh Apr 2, 2017 at 22:22
  • @StephenRauch Hmm. It works well up to the cut. sudo tcpdump -l -tttt -i wlan0 port 5353 and src <hostname> | cut -c -19 Gives the output as expected 2017-04-03 02:29:43 2017-04-03 02:29:49 2017-04-03 02:29:50 But I can't get that output back into the pipe.
    – JonFitt
    Apr 3, 2017 at 2:32

1 Answer 1


I think you need to remove the -0 from the xargs command line. The -0 is used to separate the fields via null termination, and as far as I know, cut does not support this. Instead I suggest using -d '\n' to terminate the fields at line breaks:

... | cut -c -19 | xargs -d '\n' -n1 ./timesec.sh

From the Docs


Input items are terminated by a null character instead of by whitespace, and the quotes and backslash are not special (every character is taken literally). Disables the end of file string, which is treated like any other argument. Useful when input items might contain white space, quote marks, or backslashes. The GNU find -print0 option produces input suitable for this mode.


-d delim

Input items are terminated by the specified character. Quotes and backslash are not special; every character in the input is taken literally. Disables the end-of-file string, which is treated like any other argument. This can be used when the input consists of simply newline-separated items, although it is almost always better to design your program to use --null where this is possible. The specified delimiter may be a single character, a C-style character escape such as \n, or an octal or hexadecimal escape code. Octal and hexadecimal escape codes are understood as for the printf command. Multibyte characters are not supported.

  • 1
    That was a good thought, but it didn't work. sudo tcpdump -l -tttt -i wlan0 port 5353 and src <hostname> | xargs -d '\n' -n1 echo echoes the matching packets, but sudo tcpdump -l -tttt -i wlan0 port 5353 and src <hostname> | cut -c -19 | xargs -d '\n' -n1 echo echoes nothing. cut seems to be really weird when it comes to pipes!
    – JonFitt
    Apr 4, 2017 at 4:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .