Re: is it possible to use tcpdump to display capturign information on the linux shell window while writing to pcap files

[Erik Hjelmvik <erik.hjelmvik () gmail com>]

2012/10/29 Guy Harris <guy () alum mit edu>:
> On Oct 29, 2012, at 5:48 AM, esolve esolve <esolvepolito () gmail com> wrote:
>
> > if I use tcpdump without "-w example.pcap"
> > the capturing information can be displayed on the linux shell window
> > but if I want to write the captured packets into a pcap file
> > the capturing information won't be displayed
> >
> > is there a way to  display capturign information on the linux shell window  while writing to pcap files?
>
> With tcpdump, no.

Actually, with tcpdump, yes:
tcpdump -i eth0 -U -w - | tee dump.pcap | tcpdump -n -r -

> With TShark, yes:
>
>     TShark prior to 1.8:
>
>         tshark ... -S -w example.pcap
>
>     TShark 1.8.0 and later:
>
>         tshark ... -P -w example.pcap
> ___________________________________________________________________________
> Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
> Archives:    http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>              mailto:wireshark-users-request () wireshark org?subject=unsubscribe



-- 
blog: http://www.netresec.com/?page=Blog
twitter: http://twitter.com/netresec
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe