tcpdump – How to See Packets While Capturing with tcpdump

pcaptcpdump

How can I see traffic while I am capturing it with tcpdump.

When I use -w, it doesn't show the packets during the capture.

sudo tcpdump -i enp2s0 -w test.pcap
tcpdump: listening on enp2s0, link-type EN10MB (Ethernet), capture size 262144 bytes
^C6 packets captured
7 packets received by filter
0 packets dropped by kernel

Best Answer

So after a bit of experiment, the anwser if the following :

sudo tcpdump -i enp2s0 -U -w - | tee test.pcap | tcpdump -r -

-w - : write to standard output.

-U : write packets as soon as they arrive. Don't wait until the buffer is full.

Tee will write to the file, and tcpdump -r - read the packets from standard input.

Related Topic