Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running the following version of tcpdump:

  • tcpdump version 4.0.0
  • libpcap version 1.0.0

I want to make tcpdump write to a file for each packet it captures. Currently, I could only see the captured packets if I quit tcpdump.

tcpdump -i em1 -w /tmp/pkts.pcap -s 1500

I need to quit to be able to open /tmp/pkts.pcap - until then I assume tcpdump is buffering. Is there a way to make tcpdump write to the file immediately instead of buffering?

share|improve this question
You probably could make it write to a file immediately, but the best case scenario is this: If you opened the file when tcpdump was still running you would not see the results that were written to the file after you opened it (closing and reopen the file would let you see more recent results). Worst case scenario is that tcpdump takes complete control of the file and does not allow you access to read it until tcpdump has finished. If you cannot live with either of these scenarios then you may want to look at another (more robust) solution like Wireshark – ubiquibacon Apr 21 '11 at 0:52
@typoking: thanks. wireshark would be better way.. So, no way to tweak tcpdump. there is -U option but it doesnt work in 4.0.0 i suppose.. – sudurais Apr 21 '11 at 3:13
You could try using the tail command in a separate session to view the growing log file: eg: tail -f logfilename – Linker3000 Apr 21 '11 at 6:18
"there is -U option but it doesnt work in 4.0.0 i suppose" So I assume you tried it and it didn't do what you expected? (If you didn't try it, try it before supposing that it doesn't work.) – user164970 Oct 31 '14 at 18:00

Use the -U option in combination with the -woption and check if you have a version of libcap that supports pcap_dump_flush(). From the man page (version 4.3.0-1):

   -U     If  the  -w  option  is  not  specified,  make  the  printed packet output ``packet-
          buffered''; i.e., as the description of the contents of each packet is  printed,  it
          will be written to the standard output, rather than, when not writing to a terminal,
          being written only when the output buffer fills.

          If the -w option is specified, make the saved raw packet output ``packet-buffered'';
          i.e.,  as  each  packet is saved, it will be written to the output file, rather than
          being written only when the output buffer fills.

          The -U flag will not be supported if tcpdump was built  with  an  older  version  of
          libpcap that lacks the pcap_dump_flush() function.
share|improve this answer
pcap_dump_flush() was introduced in libpcap 0.8, and the -U flag was introduced in tcpdump 3.8, so libpcap 1.0.0/tcpdump 4.0.0 have support for them. – user164970 Oct 31 '14 at 18:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.