What I actually want to do is measure tcpdump for 10s.
$ timeout 10s tcpdump > my.log
but I found there has only a short period actually being logged, instead of whole 10s.
therefore I did this experiment:
#!/bin/bash # a.sh tcpdump & p1=$! date sleep 10s; echo "Checkpoint #1" kill $p1;
$ sudo ./a.sh # works as expected $ sudo ./a.sh > my.log # not as expected # it printed 25s 27s 27s
so it actually only logged 2s.
Q1: How to do what I want?
Q2: Why print into the terminal(or pts?) is faster than into files. (I guess it's the reason.)