"tail -f" using "tcpdump -r"

Question

To display content of pcap file , we use :

tcpdump -r /Path/to/syscontection.pcap;

However, this command line does not follow the pcap file on realtime , like tail -f which follows a plain text .

• Is there an option with tcpdump which acts like -f of tail ?

OR

• Is there an option with tail that can read pcap file?

OR

• Something else ?

Solution

tail -c +1 -f /Path/to/syscontection.pcap | tcpdump -l -r -

Comments

[Admin]

tcpdump acts exactly what you want when running with no parameters.

[Admin]

This is not a duplicate question. He is asking about tcpdump's input not output.

[Dipto]

This will not work when we want to read from multiple files, what will be the solution for tcpdump -l -r file1,file2 e.g. ? tail -c +1 -f file1 -f file2 | tcpdump -l -r - will not work since tail will output some extra lines while tailing multiple files

[drHogan]

@Dipto I guess you could simply two or more of these pipe command lines in backround. ( tail -c +1 -f a.pcap | tcpdump -l -r - & tail -c +1 -f b.pcap | tcpdump -l -r - & )

[Dipto]

Thanks. But what I found is tcpdump -r /Path/to/pcap is able to follow the file in realtime as it is. May be OP is facing another problem superuser.com/questions/735017/…