Piping tcpdump to awk stutters

aaargh486 · 08-19-2007, 06:21 PM

When i do this "tcpdump | awk '{ print $1 }'" or "tcpdump -l | awk '{print $1 }', the output stutters, I have to wait a long time and suddenly a lot of outputs pop up, while the normal tcpdump gives me fluent output.
The waiting time is sometimes enormously long, minutes long, and suddenly outputting 1000+ lines.

Is this a problem with tcpdump or with awk?

I hope you can help me, THanks in advance.

PS: My real script is longer, these are just examples.

chrism01 · 08-19-2007, 08:08 PM

iirc, awk waits for an end-of-input signal or end-of-line char before it tries to process stuff.
I could be wrong ...

aaargh486 · 08-20-2007, 10:31 AM

Any idea how I can make it process line per line?
If that doesn't work, I'll just code it in Perl...

chrism01 · 08-20-2007, 07:47 PM

If you want to do it your way, I think you'd have to decide exactly which char value you want awk to treat as 'end-of-line' and see if you can tell awk to do that.
I hardly use awk, so you need to some research and/or hope one of the awk guys here chips in.
Personally, I do use Perl, so I'd go that route myself.
YMMV
sorry I can't be more helpful.
BTW, do you need to do this in realtime, or could you use the save-to-file option tcpdump has?

aaargh486 · 08-21-2007, 06:53 AM

Yes it needs to respond INSTANTLY. So I'll go with Perl.
I've never worked with Net::Pcap, but I looks easy as pie.

Thanks anyway, I never liked awk.

ghostdog74 · 08-21-2007, 08:50 AM

Quote:

Originally Posted by aaargh486

When i do this "tcpdump | awk '{ print $1 }'" or "tcpdump -l | awk '{print $1 }', the output stutters, I have to wait a long time and suddenly a lot of outputs pop up, while the normal tcpdump gives me fluent output.
The waiting time is sometimes enormously long, minutes long, and suddenly outputting 1000+ lines.

Is this a problem with tcpdump or with awk?

I hope you can help me, THanks in advance.

PS: My real script is longer, these are just examples.

what exactly do you want to capture? tcpdump output's column 1 is the date, at least on my system. Do you just want to get the date? if you are looking at tcpdump output, i don't think you just want to get the date, right? you might be better off using tcpdump's extensive filtering options to get what you want.

aaargh486 · 08-22-2007, 05:27 AM

I was looking for the source and the destination's MAC address and their IP address. Also I needed the sequence number. I filtered out all packets with the ACK packet enabled.

But It doesn't matter I programmed it yesterday in Perl.

http://home.scarlet.be/~umeerts/hijack_rst.pl

Thanks anyway.

chrism01 · 08-22-2007, 08:56 PM

I think you want
or die "..."
instead of
&& die
and instead of
|| die
This last is due to precedence rules: 'or' is preferred to '||' in this context.

Personally, I (and most Perl guys) recommend
#!/usr/bin/perl -w
or
use warnings;