How can I have tcpdump write to file and standard output the appropriate data?
LinuxTcpdumpLinux Problem Overview
I want to have tcpdump
write raw packet data into a file and also display packet analysis into standard output as the packets are captured (by analysis I mean the lines it displays normally when -w
is missing).
Can anybody please tell me how to do that?
Linux Solutions
Solution 1 - Linux
Here's a neat way to do what you want:
tcpdump -w - | tee somefile | tcpdump -r -
What it does:
-w -
tellstcpdump
to write binary data tostdout
tee
writes that binary data to a file AND to its ownstdout
-r -
tells the secondtcpdump
to get its data from itsstdin
Solution 2 - Linux
Since tcpdump 4.9.3 4.99.0, the --print
option can be used:
tcpdump -w somefile --print
Wednesday, December 30, 2020, by mcr@sandelman.ca, denis and fxl.
Summary for 4.99.0 tcpdump release
[...]
User interface:
[...]
Add --print, to cause packet printing even with -w.
Solution 3 - Linux
tcpdump ${ARGS} &
PID=$!
tcpdump ${ARGS} -w ${filename}
kill $PID
Solution 4 - Linux
If you want a way to do it without running tcpdump twice, consider:
sudo tcpdump port 80 -w $(tty) | tee /tmp/output.txt
From the interactive command prompt you could use $TTY
instead of $(tty)
but in a script the former wouldn't be set (though I'm not sure how common it is to run tcpdump in a script).
Side-note: it's not very Unix-y the way tcpdump by default makes you write to a file. Programs should by default write to stdout. Redirection to a file is already provided by the shell constructs. Maybe there's a good reason tcpdump is designed this way but I don't know what that is.