I am issuing a command to a remote device in order to run a tcpdump on one of it's interfaces, but capture the output to a local .pcap file on my Ubuntu VM. The command that I'm issuing is as follows:

drew@Drew-Ubuntu:~/Desktop$ sshpass -p $password ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -T $username@$remote-ip -p $remote-port << EOF \ > /home/drew/Desktop/Example_Capture.pcap
> sh
> tcpdump -i eth5.1 -s 0 -n -v not host $local-ip -w -
tcpdump: listening on eth5.1, link-type EN10MB (Ethernet), capture size 65535 bytes
^Ct 23

The issue that I'm having is that this does allow me to start up a tcpdump. I can see the "Got $counter" values increasing as the tcpdump runs which is great. I can then simply "CTRL + c" in order to stop the capture and my file is generated at my specified location. The issue is that the first command "> sh" shows up in the very first line of this capture file, which stops me from being able to properly open this file for review.

I've tried adding "> sh > /dev/null", but I'm pretty sure that is only going to suppress output on the remote side, and not mine, as it didn't work. I've tried messing with the syntax of this a bunch, but either my command doesn't work entirely, or that first line is included. Hoping there is a proper syntax out there to just populate my local file with the tcpdump information.


I have since tried to update things to work within a single script that runs my tcpdump capture, and then once cancelled out, sed would clean up the first line as needed. Below is what I have built:


read -p $'\e[32mEnter Remote IP: \e[0m' remote_ip
read -p $'\e[32mEnter Username: \e[0m' username
read -sp $'\e[32mEnter Password: \e[0m' password
read -p $'\e[32mEnter File Save Location and Name: \e[0m' save_file
echo -e '\e[32mEnter tcpdump Options (ie. -i eth1 -s 0 .....)\e[0m'
read -p $'\e[32m*note: You do not need to enter the \"-w\" modifier to save to a file: \e[0m' tcpdump_options

sshpass -p $password ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -T $username@$remote_ip -p 30007 <<- EOF \ > /tmp/Remote_Capture.pcap
        tcpdump $tcpdump_options -U -w -

trap '{ sed 1d /tmp/Remote_Capture.pcap > $save_file; rm /tmp/Remote_Capture.pcap; }' SIGINT SIGTERM

The issue with this is that when I enter a CTRL+C, it seems to terminate out of the entire script and not make it to that final line. My capture file gets created in my /tmp directory with that extra line up top, but the sed operations don't actually happen to clean things up and push the cleaned up file to my set location.

  • Just to pin it down, you have to enter the sh command before being able to execute tcpdump?
    – Jeff Schaller
    Commented Feb 1, 2019 at 17:28
  • @JeffSchaller - Correct, for the remote device I'm connecting to, it doesn't immediately drop me to the linux shell of the device, so issuing the "sh" puts my in the proper shell to run my tcpdump. I truly wish it didn't or this would all be so much simpler as I've done on other devices.
    – Drew
    Commented Feb 1, 2019 at 17:32

1 Answer 1


You could strip off the first line before the redirection into your file:

sshpass ... "$remote-port" | sed 1d << EOF > /home/drew/Desktop/Example_Capture.pcap
tcpdump -i eth5.1 -s 0 -n -v not host $local-ip -w -
  • Thanks Jeff. I gave that syntax a shot, but then I'm receiving "sed: can't read : No such file or directory"
    – Drew
    Commented Feb 1, 2019 at 17:37
  • interesting; perhaps you have to tell sed it's a script? ... sed -e 1d ...
    – Jeff Schaller
    Commented Feb 1, 2019 at 17:41
  • No success adding that modifier either. Same error message is received.
    – Drew
    Commented Feb 1, 2019 at 17:46
  • In that vein, just to make sure there wasn't something seriously weird going on, I took my normal capture than just did a "sed 1d Example_Capture.pcap > Fixed_Capture.pcap" and validated that the first line is properly removed and I'm able to open and view the file in Wireshark without any error.
    – Drew
    Commented Feb 1, 2019 at 17:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .