2

I used tcpdump to capture packets from local rsyslog service to syslog server, however, when I tried different commands (with/without dst option) in tcpdump, the displayed result has a delay.

Expected/Desired Behavior:

tcpdump -n -e -i any -A | grep hello               # without dst option
tcpdump -n -e -i any dst 10.8.8.3 -A | grep hello  # with dst option

The above two commands should display the packets simultaneously or with very short delay.

Actual Behavior: Command with dst option tcpdump -n -e -i any dst 10.8.8.3 -A | grep hello display the packet with a delay of up to 20 secs, which makes me mistakenly think that the packet is not sent successfully.

command1 captures the packet immediately

enter image description here

command2 cannot capture the packet immediately. After about 20 seconds, the packet finally display on the screen.

Additional Infomation:

  • Debian 4.9.189-3+deb9u2 (2019-11-11) x86_64 GNU/Linux
  • tcpdump version 4.9.3
  • libpcap version 1.8.1

1 Answer 1

1

From tcpdump(8) (choosing slightly older than OP's version, but any newer would do):

-l

Make stdout line buffered. Useful if you want to see the data while capturing it. E.g.,

tcpdump -l | tee dat

or

tcpdump -l > dat & tail -f dat

[...]

-U is similar to -l in its behavior, but it will cause output to be ``packet-buffered'', [...]

So just add -l to tcpdump whenever you need "real time" display.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .