I'm trying to write the results of tcpdump to a text file. I am not interested in saving a pcap file to use later, I just need exactly what tcpdump returns in plain text (the ips and timestamps of connections).

I tried this but it doesn't seem to be working:

tcpdump port 5000 and '(tcp-syn)!=0' > network_output.txt

This command should save to the textfile but instead it echo's the output right in the termial as if I left the > network_output.txt off.

migrated from stackoverflow.com Jun 7 '13 at 17:57

This question came from our site for professional and enthusiast programmers.

  • What did you mean by and '(tcp-syn)!=0'? Should it be a comparison, then you forgot to make it a var: and [[ ${tcp-syn} -ne 0 ]]. – Rubens Jun 7 '13 at 16:58
  • I'm not sure. I didn't know what it did either but a friend told me to use it. – tajonny07 Jun 7 '13 at 17:00
  • Then, why not just tcpdump port 5000 > ...? – Rubens Jun 7 '13 at 17:01
  • Well sure I can, but its still not writing to the file. – tajonny07 Jun 7 '13 at 17:05
  • 2
    Use tcpdump port 5000 &> network_output.txt. This shall redirect both stdout and stderr to your file. Andalso, you seem to be running tcpdump with incorrect arguments. Use man tcpdump for reference. – Rubens Jun 7 '13 at 17:10

What operating system and shell are you using? (Your command works fine for me on my system.)

Try tcpdump port 5000 and '(tcp-syn)!=0' &> network_output.txt (notice &> instead of >) and see if that does what you want. It combines the Standard Output with the Error Output into one file. Although it's called the Error Output, that second output stream is often used for output meant for an interactive terminal such as progress information.

If that doesn't work, try:

script network_output.txt
tcpdump  port 5000 and '(tcp-syn)!=0'

then Ctrl-C to quit tcpdump and Ctrl-D to exit script. You will get extra junk in the file but it will have all the terminal output as well.

  • Thanks for the reply. This is interesting. It 'did' work or so I thought, as the 'listening on port 5000...' got written to the text file, but when I make a connection the '0.0.0.0 has connected ..' that its supposed to be also written isnt. when I do the command by iteslf I have many lines coming up as clients connect, but it doesn't seem to be doing that when I write it to the file.. PS I'm using CentOS 5.9 – tajonny07 Jun 7 '13 at 17:25
  • Try using script. – Old Pro Jun 7 '13 at 17:32

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.