I'm running the following version of tcpdump:
- tcpdump version 4.0.0
- libpcap version 1.0.0
I want to make tcpdump write to a file for each packet it captures. Currently, I could only see the captured packets if I quit tcpdump.
tcpdump -i em1 -w /tmp/pkts.pcap -s 1500
I need to quit to be able to open
/tmp/pkts.pcap - until then I assume tcpdump is buffering. Is there a way to make tcpdump write to the file immediately instead of buffering?