I'm running tshark on a fifo, and the following is a bare example of a loop that prints the output of tshark as it comes:
tshark -i $fifo | while read line; do echo $line done
The problem appears when I add filters to tshark. This example prints all
$lines only after tshark exits (IP address is hidden):
tshark -i $fifo -T fields -e text -R ' ip.src == **.**.***.** && http.response.code == 200 && http.content_encoding == "gzip" && http.content_type contains "text/html" ' | while read line; do echo $line done
I have tried in other forms with no luck:
while read line; do echo $line done < <(tshark ...) while read line; do echo $line done <<<"$(tshark ...)"
Even grep prints the lines only after tshark ends:
tshark ... | grep .
I have tried running tshark without a pipe and the lines are printed correctly as they come. Why is the command after the pipe being feeded only after tshark exits?
| tee works, but I get everything printed again when tshark exits, so it is not a good deal.
Check if your
tshark version has the
-l option for (nearly) line-buffered output.
tshark -l ... | grep . | grep .doesn't work, whereas
tshark -l ... | stdbuf -o 0 grep . | grep .works, so all information on this thread was useful. Thanks everybody so much for all the help! — Apr 15, 2013 at 15:20
External links referenced by this document: