Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to start tcpdump on several remote machines to perform some network analysis with a script, but I'm failing to run it correctly. The command I would like to use is:

ssh user@host "nohup sudo /usr/sbin/tcpdump udp -l -s 68 -n -v -i eth0 1>tcpdump.txt 2>tcpdump.err &"

With the intention to start tcpdump remotely, pipe the results to file and return immediately. Not having a keyboard installed on the remote machine, all I get is

sudo: no tty present and no askpass program specified

written in tcpdump.err. I also tried:

  • writing the command in a bash script and running the script remotely
  • enclosing the sudo part in the 'script' command (script -c 'nohup sudo...')

but with no success. Is there some other alternatives I can try?

share|improve this question
Have you tried ssh -t to force pseudo-tty allocation? – parkydr Jan 14 '13 at 10:39
I'm sorry, I forgot to mention that alternative: I have already tried using the -t option, both once and twice ("ssh -t -t ...") – Satto Jan 14 '13 at 12:49

You're using sudo in your command, which will require authentication, unless configured otherwise on the remote host. You'll be forced to enter a password to authenticate unless you try something like

user NOPASSWD: /usr/sbin/tcpdump

in the sudoers file on the remote host.

This can have serious security implications; if someone were to hack into the system as this user (or just sit down at one of their logged in consoles), they could tcpdump all traffic to/from that host without authenticating as root or that user.

Check out the tag_spec section of the sudoers man page for more details.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .