Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm running the following version of tcpdump:

  • tcpdump version 4.0.0
  • libpcap version 1.0.0

I want to make tcpdump write to a file for each packet it captures. Currently, I could only see the captured packets if I quit tcpdump.

tcpdump -i em1 -w /tmp/pkts.pcap -s 1500

I need to quit to be able to open /tmp/pkts.pcap - until then I assume tcpdump is buffering. Is there a way to make tcpdump write to the file immediately instead of buffering?

share|improve this question
    
You probably could make it write to a file immediately, but the best case scenario is this: If you opened the file when tcpdump was still running you would not see the results that were written to the file after you opened it (closing and reopen the file would let you see more recent results). Worst case scenario is that tcpdump takes complete control of the file and does not allow you access to read it until tcpdump has finished. If you cannot live with either of these scenarios then you may want to look at another (more robust) solution like Wireshark –  ubiquibacon Apr 21 '11 at 0:52
    
@typoking: thanks. wireshark would be better way.. So, no way to tweak tcpdump. there is -U option but it doesnt work in 4.0.0 i suppose.. –  sudurais Apr 21 '11 at 3:13
    
You could try using the tail command in a separate session to view the growing log file: eg: tail -f logfilename –  Linker3000 Apr 21 '11 at 6:18
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.