I need to run tcpdump on some switch and pass it through grep with advanced regexp. That switch shell ist quite stupid and there is no grep with regexp but there is a tcpdump with the options I need.

Is there a way to run tcpdump on the switch terminal and pass the whole output to another Linux machine, e.g. to a file on that machine, so then I could just grep that file online and see what is happening in a live session?


In case you have SSH access to your switch you can simply do

ssh switch 'tcpdump <args>' | grep <fancy pattern>

Note that in contrast to the netcat solution proposed by @DopeGhoti this might be slightly slower (depending on the CPU of the switch) but your data is transferred encrypted. Depending the environment you're working in and the sensitivity of the data you're capturing this might or might not make a difference.


Why not let the Switch just do what a Switch does (move packets) and use netcat to carry your text from one host to another?

Let's say you want to send on TCP port 12345. On the listener host ("remotehost.example.com", for instance):

$ nc -l 12345 | grep 'pattern'

On the sender host:

$ /path/to/somejob | nc remotehost.example.com 12345
  • remotehost.example.com is the listener host. – Eduardo Trápani Jun 9 '20 at 21:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.