[nSLUG] April Tech Talk

Dop Ganger nslug at fop.ns.ca
Wed Apr 22 15:46:26 ADT 2015


On Wed, 22 Apr 2015, Mike Spencer wrote:

> If I pipe tcpdump through " | tee logfile", output from tcpdump gets
> buffered up somewhere.  Both the stdout and the logfile get updated in
> spurts that may break the tcpdump output in the middle of a line.

I think you may want "tcpdump -l". Checking the man page on a local 
machine this exact scenario is actually listed, coincidentally enough:

" -l Make stdout line buffered.  Useful if you want to see the data while 
capturing it.  E.g.,

  tcpdump -l | tee dat

or

  tcpdump -l > dat & tail -f dat

  Note that on Windows,``line buffered'' means ``unbuffered'', so that 
WinDump will write each character individually if -l is specified.

  -U is similar to -l in its behavior, but it will cause output to be 
``packet-buffered'', so that the output is written to stdout at the end of 
each packet rather than at the end of each line; this is buffered on all 
platforms, including Windows."

Cheers... Dop.


More information about the nSLUG mailing list