I'm trying to run the following:
$ tcpdump -l -X -i eth1 -n tcp port <port> | tee capture.txt | \ scp capture.txt [email protected]:/home/checker/
tcpdump -l -X -i eth1 -n tcp port <port>
In step #1 I'm capturing packets, using "-l" to to make standard out line-buffered, so that it will write each packet as it arrives.
In step #2
man tee: "The tee utility copies standard input to standard output, making a copy in zero or more files." The output is unbuffered.
scp capture.txt root@<remote-IP>:/home/
In step #3 I'm send the capture.txt file to a remote host.
If I simply perform steps #1 and #2, ALL packets are captured on the specified port. However, if I also use step #3 the
capture.txt does NOT contain all the packets (only a few)... This is killing me because I had this running OK just a few minutes ago!
What is wrong here?