I'm running tshark on a fifo, and the following is a bare example of a loop that prints the output of tshark as it comes:
tshark -i $fifo | while read line; do
echo $line
done
The problem appears when I add filters to tshark. This example prints all $line
s only after tshark exits (IP address is hidden):
tshark -i $fifo -T fields -e text -R '
ip.src == **.**.***.** &&
http.response.code == 200 &&
http.content_encoding == "gzip" &&
http.content_type contains "text/html"
' | while read line; do
echo $line
done
I have tried in other forms with no luck:
while read line; do
echo $line
done < <(tshark ...)
while read line; do
echo $line
done <<<"$(tshark ...)"
Even grep prints the lines only after tshark ends:
tshark ... | grep .
I have tried running tshark without a pipe and the lines are printed correctly as they come. Why is the command after the pipe being feeded only after tshark exits?
Additional details: | tee
works, but I get everything printed again when tshark exits, so it is not a good deal.
Check if your tshark
version has the -l
option for (nearly) line-buffered output.
tshark -l ... | grep . | grep .
doesn't work, whereas tshark -l ... | stdbuf -o 0 grep . | grep .
works, so all information on this thread was useful. Thanks everybody so much for all the help! — Apr 15, 2013 at 15:20 External links referenced by this document: