LinuxQuestions.org - tcpdump over ssh works only some times

- Linux - Networking (https://www.linuxquestions.org/questions/linux-networking-3/)

- - tcpdump over ssh works only some times (https://www.linuxquestions.org/questions/linux-networking-3/tcpdump-over-ssh-works-only-some-times-926521/)

tcpdump over ssh works only some times

I'm trying to send a tcpdump to own computer via ssh, commad:

Code:

# mkfifo /tmp/pcap

# ssh root@192.168.1.1 "tcpdump -i bge0 -s -0 -w -" > /tmp/pcap

After a short while I'm prompted for password, and then I can use wireshark to capture from /tmp/pcap.
This works a few times, then suddenly it just stalls - nothing happens, I'm not prompted for password, nothing is sent to /tmp/pcap.

I have left the terminal for half an hour, checked my logs (nothing logged anywhere during ssh to other).
/tmp/pcap exists, I have tried creating a new "/tmp/pcap2" and use that, no difference.
I tried against different hosts, no difference.
If I remove the redirect (everything from '>') it works fine - I'm immediately prompted for password, upon login tcpdump starts. (But not sent to /tmp/pcap of course.)

I don't really know how to troubleshoot this, any help is much appreciated!

Next time, start reading from the named pipe before you begin writing to it, a la:

Code:

# cat /tmp/pcap

# ... ssh command here that writes to /tmp/pcap ...

Thing is: why use a named pipe for this at all? tcpdump(1) can write to a capture file for your later review. Or it can simply write to stdout for you to review in a terminal.