Unix & Linux
bash shell pipe fifo tshark
Updated Thu, 06 Oct 2022 11:09:37 GMT

Can't process stdout with pipe as it comes


I'm running tshark on a fifo, and the following is a bare example of a loop that prints the output of tshark as it comes:

tshark -i $fifo | while read line; do
    echo $line
done

The problem appears when I add filters to tshark. This example prints all $lines only after tshark exits (IP address is hidden):

tshark -i $fifo -T fields -e text -R '
    ip.src == **.**.***.**          &&
    http.response.code == 200       &&
    http.content_encoding == "gzip" &&
    http.content_type contains "text/html"
' | while read line; do
    echo $line
done

I have tried in other forms with no luck:

while read line; do
    echo $line
done < <(tshark ...)
while read line; do
    echo $line
done <<<"$(tshark ...)"

Even grep prints the lines only after tshark ends:

tshark ... | grep .

I have tried running tshark without a pipe and the lines are printed correctly as they come. Why is the command after the pipe being feeded only after tshark exits?

Additional details: | tee works, but I get everything printed again when tshark exits, so it is not a good deal.




Solution

Check if your tshark version has the -l option for (nearly) line-buffered output.





Comments (1)

  • +1 – Right, this is the fix on the tshark part. Although, as I have shown in my own answer, if more than one pipe is going to be used, the others will have to be fixed too. As a simple example, tshark -l ... | grep . | grep . doesn't work, whereas tshark -l ... | stdbuf -o 0 grep . | grep . works, so all information on this thread was useful. Thanks everybody so much for all the help! — Apr 15, 2013 at 15:20  


External Links

External links referenced by this document: