How can i see packets while capturing with tcpdump The Next CEO of Stack Overflowtcpdump and dynamic dns updatetcpdump: capture one of several vlanstcpdump - how to check rate of packets?Capturing on loopback device on Ubuntu LTS: 15 Mbit of traffic and “x dropped packets”Tcpdump stops capturing wifi data while running in the backgroundMaking TCP dump without packets lossPacket captures: filtering on RX vs TXtcpdump on bridge interface (virbr) does not receive any packets destined for one of its addressestcpdump - filter applies after some time?Use tcpdump to capture an ICMP destination unreachable message

Example of a Mathematician/Physicist whose Other Publications during their PhD eclipsed their PhD Thesis

I believe this to be a fraud - hired, then asked to cash check and send cash as Bitcoin

How to count occurrences of text in a file?

Opposite of a diet

What happens if you roll doubles 3 times then land on "Go to jail?"

Customer Requests (Sometimes) Drive Me Bonkers!

How to get regions to plot as graphics

Is it okay to store user locations?

Need some help with wall behind rangetop

Should I tutor a student who I know has cheated on their homework?

Why were Madagascar and New Zealand discovered so late?

What do "high sea" and "carry" mean in this sentence?

Whats the best way to handle refactoring a big file?

How did people program for Consoles with multiple CPUs?

Why does standard notation not preserve intervals (visually)

How long to clear the 'suck zone' of a turbofan after start is initiated?

How should I support this large drywall patch?

% symbol leads to superlong (forever?) compilations

Why do remote companies require working in the US?

How to write papers efficiently when English isn't my first language?

Term for the "extreme-extension" version of a straw man fallacy?

Anatomically Correct Mesopelagic Aves

What does "Its cash flow is deeply negative" mean?

Can a caster that cast Polymorph on themselves stop concentrating at any point even if their Int is low?



How can i see packets while capturing with tcpdump



The Next CEO of Stack Overflowtcpdump and dynamic dns updatetcpdump: capture one of several vlanstcpdump - how to check rate of packets?Capturing on loopback device on Ubuntu LTS: 15 Mbit of traffic and “x dropped packets”Tcpdump stops capturing wifi data while running in the backgroundMaking TCP dump without packets lossPacket captures: filtering on RX vs TXtcpdump on bridge interface (virbr) does not receive any packets destined for one of its addressestcpdump - filter applies after some time?Use tcpdump to capture an ICMP destination unreachable message










0















How can I see traffic while I am capturing it with tcpdump.



When I use -w, it doesn't show the packets during the capture.



sudo tcpdump -i enp2s0 -w test.pcap
tcpdump: listening on enp2s0, link-type EN10MB (Ethernet), capture size 262144 bytes
^C6 packets captured
7 packets received by filter
0 packets dropped by kernel









share|improve this question







New contributor




Olivier Lasne is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
























    0















    How can I see traffic while I am capturing it with tcpdump.



    When I use -w, it doesn't show the packets during the capture.



    sudo tcpdump -i enp2s0 -w test.pcap
    tcpdump: listening on enp2s0, link-type EN10MB (Ethernet), capture size 262144 bytes
    ^C6 packets captured
    7 packets received by filter
    0 packets dropped by kernel









    share|improve this question







    New contributor




    Olivier Lasne is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
    Check out our Code of Conduct.






















      0












      0








      0








      How can I see traffic while I am capturing it with tcpdump.



      When I use -w, it doesn't show the packets during the capture.



      sudo tcpdump -i enp2s0 -w test.pcap
      tcpdump: listening on enp2s0, link-type EN10MB (Ethernet), capture size 262144 bytes
      ^C6 packets captured
      7 packets received by filter
      0 packets dropped by kernel









      share|improve this question







      New contributor




      Olivier Lasne is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
      Check out our Code of Conduct.












      How can I see traffic while I am capturing it with tcpdump.



      When I use -w, it doesn't show the packets during the capture.



      sudo tcpdump -i enp2s0 -w test.pcap
      tcpdump: listening on enp2s0, link-type EN10MB (Ethernet), capture size 262144 bytes
      ^C6 packets captured
      7 packets received by filter
      0 packets dropped by kernel






      tcpdump pcap






      share|improve this question







      New contributor




      Olivier Lasne is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
      Check out our Code of Conduct.











      share|improve this question







      New contributor




      Olivier Lasne is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
      Check out our Code of Conduct.









      share|improve this question




      share|improve this question






      New contributor




      Olivier Lasne is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
      Check out our Code of Conduct.









      asked 19 hours ago









      Olivier LasneOlivier Lasne

      1111




      1111




      New contributor




      Olivier Lasne is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
      Check out our Code of Conduct.





      New contributor





      Olivier Lasne is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
      Check out our Code of Conduct.






      Olivier Lasne is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
      Check out our Code of Conduct.




















          3 Answers
          3






          active

          oldest

          votes


















          2














          -w option is to write the tcpdump output to a file. you can remove that option if you want to print on your terminal.






          share|improve this answer








          New contributor




          Rachel is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
          Check out our Code of Conduct.



























            2














            Since you are using the option -w, the packets are being saved to the file and not displayed at the standard output. Here from the tcpdumup manpage:



            https://www.tcpdump.org/manpages/tcpdump.1.html



            -w file
            Write the raw packets to file rather than parsing and printing them out. They can later be printed with the -r option. Standard output is used if file is ``-''.
            This output will be buffered if written to a file or pipe, so a program reading from the file or pipe may not see packets for an arbitrary amount of time after they are received. Use the -U flag to cause packets to be written as soon as they are received.
            The MIME type application/vnd.tcpdump.pcap has been registered with IANA for pcap files. The filename extension .pcap appears to be the most commonly used along with .cap and .dmp. Tcpdump itself doesn't check the extension when reading capture files and doesn't add an extension when writing them (it uses magic numbers in the file header instead). However, many operating systems and applications will use the extension if it is present and adding one (e.g. .pcap) is recommended.
            See pcap-savefile(5) for a description of the file format.


            If you want to do both at the same time, here is a way to achieve that:



            How can I have tcpdump write to file and standard output the appropriate data?






            share|improve this answer
































              1














              So after a bit of experiment, the anwser if the following :



              sudo tcpdump -i enp2s0 -U -w - | tee test.pcap | tcpdump -r -


              -w - : write to standard output.



              -U : write packets as soon as they arrive. Don't wait until the buffer is full.



              Tee will write to the file, and tcpdump -r - read the packets from standard input.






              share|improve this answer








              New contributor




              Olivier Lasne is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
              Check out our Code of Conduct.




















                Your Answer








                StackExchange.ready(function()
                var channelOptions =
                tags: "".split(" "),
                id: "2"
                ;
                initTagRenderer("".split(" "), "".split(" "), channelOptions);

                StackExchange.using("externalEditor", function()
                // Have to fire editor after snippets, if snippets enabled
                if (StackExchange.settings.snippets.snippetsEnabled)
                StackExchange.using("snippets", function()
                createEditor();
                );

                else
                createEditor();

                );

                function createEditor()
                StackExchange.prepareEditor(
                heartbeatType: 'answer',
                autoActivateHeartbeat: false,
                convertImagesToLinks: true,
                noModals: true,
                showLowRepImageUploadWarning: true,
                reputationToPostImages: 10,
                bindNavPrevention: true,
                postfix: "",
                imageUploader:
                brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
                contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
                allowUrls: true
                ,
                onDemand: true,
                discardSelector: ".discard-answer"
                ,immediatelyShowMarkdownHelp:true
                );



                );






                Olivier Lasne is a new contributor. Be nice, and check out our Code of Conduct.









                draft saved

                draft discarded


















                StackExchange.ready(
                function ()
                StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f960405%2fhow-can-i-see-packets-while-capturing-with-tcpdump%23new-answer', 'question_page');

                );

                Post as a guest















                Required, but never shown

























                3 Answers
                3






                active

                oldest

                votes








                3 Answers
                3






                active

                oldest

                votes









                active

                oldest

                votes






                active

                oldest

                votes









                2














                -w option is to write the tcpdump output to a file. you can remove that option if you want to print on your terminal.






                share|improve this answer








                New contributor




                Rachel is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
                Check out our Code of Conduct.
























                  2














                  -w option is to write the tcpdump output to a file. you can remove that option if you want to print on your terminal.






                  share|improve this answer








                  New contributor




                  Rachel is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
                  Check out our Code of Conduct.






















                    2












                    2








                    2







                    -w option is to write the tcpdump output to a file. you can remove that option if you want to print on your terminal.






                    share|improve this answer








                    New contributor




                    Rachel is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
                    Check out our Code of Conduct.










                    -w option is to write the tcpdump output to a file. you can remove that option if you want to print on your terminal.







                    share|improve this answer








                    New contributor




                    Rachel is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
                    Check out our Code of Conduct.









                    share|improve this answer



                    share|improve this answer






                    New contributor




                    Rachel is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
                    Check out our Code of Conduct.









                    answered 19 hours ago









                    RachelRachel

                    213




                    213




                    New contributor




                    Rachel is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
                    Check out our Code of Conduct.





                    New contributor





                    Rachel is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
                    Check out our Code of Conduct.






                    Rachel is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
                    Check out our Code of Conduct.























                        2














                        Since you are using the option -w, the packets are being saved to the file and not displayed at the standard output. Here from the tcpdumup manpage:



                        https://www.tcpdump.org/manpages/tcpdump.1.html



                        -w file
                        Write the raw packets to file rather than parsing and printing them out. They can later be printed with the -r option. Standard output is used if file is ``-''.
                        This output will be buffered if written to a file or pipe, so a program reading from the file or pipe may not see packets for an arbitrary amount of time after they are received. Use the -U flag to cause packets to be written as soon as they are received.
                        The MIME type application/vnd.tcpdump.pcap has been registered with IANA for pcap files. The filename extension .pcap appears to be the most commonly used along with .cap and .dmp. Tcpdump itself doesn't check the extension when reading capture files and doesn't add an extension when writing them (it uses magic numbers in the file header instead). However, many operating systems and applications will use the extension if it is present and adding one (e.g. .pcap) is recommended.
                        See pcap-savefile(5) for a description of the file format.


                        If you want to do both at the same time, here is a way to achieve that:



                        How can I have tcpdump write to file and standard output the appropriate data?






                        share|improve this answer





























                          2














                          Since you are using the option -w, the packets are being saved to the file and not displayed at the standard output. Here from the tcpdumup manpage:



                          https://www.tcpdump.org/manpages/tcpdump.1.html



                          -w file
                          Write the raw packets to file rather than parsing and printing them out. They can later be printed with the -r option. Standard output is used if file is ``-''.
                          This output will be buffered if written to a file or pipe, so a program reading from the file or pipe may not see packets for an arbitrary amount of time after they are received. Use the -U flag to cause packets to be written as soon as they are received.
                          The MIME type application/vnd.tcpdump.pcap has been registered with IANA for pcap files. The filename extension .pcap appears to be the most commonly used along with .cap and .dmp. Tcpdump itself doesn't check the extension when reading capture files and doesn't add an extension when writing them (it uses magic numbers in the file header instead). However, many operating systems and applications will use the extension if it is present and adding one (e.g. .pcap) is recommended.
                          See pcap-savefile(5) for a description of the file format.


                          If you want to do both at the same time, here is a way to achieve that:



                          How can I have tcpdump write to file and standard output the appropriate data?






                          share|improve this answer



























                            2












                            2








                            2







                            Since you are using the option -w, the packets are being saved to the file and not displayed at the standard output. Here from the tcpdumup manpage:



                            https://www.tcpdump.org/manpages/tcpdump.1.html



                            -w file
                            Write the raw packets to file rather than parsing and printing them out. They can later be printed with the -r option. Standard output is used if file is ``-''.
                            This output will be buffered if written to a file or pipe, so a program reading from the file or pipe may not see packets for an arbitrary amount of time after they are received. Use the -U flag to cause packets to be written as soon as they are received.
                            The MIME type application/vnd.tcpdump.pcap has been registered with IANA for pcap files. The filename extension .pcap appears to be the most commonly used along with .cap and .dmp. Tcpdump itself doesn't check the extension when reading capture files and doesn't add an extension when writing them (it uses magic numbers in the file header instead). However, many operating systems and applications will use the extension if it is present and adding one (e.g. .pcap) is recommended.
                            See pcap-savefile(5) for a description of the file format.


                            If you want to do both at the same time, here is a way to achieve that:



                            How can I have tcpdump write to file and standard output the appropriate data?






                            share|improve this answer















                            Since you are using the option -w, the packets are being saved to the file and not displayed at the standard output. Here from the tcpdumup manpage:



                            https://www.tcpdump.org/manpages/tcpdump.1.html



                            -w file
                            Write the raw packets to file rather than parsing and printing them out. They can later be printed with the -r option. Standard output is used if file is ``-''.
                            This output will be buffered if written to a file or pipe, so a program reading from the file or pipe may not see packets for an arbitrary amount of time after they are received. Use the -U flag to cause packets to be written as soon as they are received.
                            The MIME type application/vnd.tcpdump.pcap has been registered with IANA for pcap files. The filename extension .pcap appears to be the most commonly used along with .cap and .dmp. Tcpdump itself doesn't check the extension when reading capture files and doesn't add an extension when writing them (it uses magic numbers in the file header instead). However, many operating systems and applications will use the extension if it is present and adding one (e.g. .pcap) is recommended.
                            See pcap-savefile(5) for a description of the file format.


                            If you want to do both at the same time, here is a way to achieve that:



                            How can I have tcpdump write to file and standard output the appropriate data?







                            share|improve this answer














                            share|improve this answer



                            share|improve this answer








                            edited 17 hours ago

























                            answered 19 hours ago









                            DiamantDiamant

                            7,52331633




                            7,52331633





















                                1














                                So after a bit of experiment, the anwser if the following :



                                sudo tcpdump -i enp2s0 -U -w - | tee test.pcap | tcpdump -r -


                                -w - : write to standard output.



                                -U : write packets as soon as they arrive. Don't wait until the buffer is full.



                                Tee will write to the file, and tcpdump -r - read the packets from standard input.






                                share|improve this answer








                                New contributor




                                Olivier Lasne is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
                                Check out our Code of Conduct.
























                                  1














                                  So after a bit of experiment, the anwser if the following :



                                  sudo tcpdump -i enp2s0 -U -w - | tee test.pcap | tcpdump -r -


                                  -w - : write to standard output.



                                  -U : write packets as soon as they arrive. Don't wait until the buffer is full.



                                  Tee will write to the file, and tcpdump -r - read the packets from standard input.






                                  share|improve this answer








                                  New contributor




                                  Olivier Lasne is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
                                  Check out our Code of Conduct.






















                                    1












                                    1








                                    1







                                    So after a bit of experiment, the anwser if the following :



                                    sudo tcpdump -i enp2s0 -U -w - | tee test.pcap | tcpdump -r -


                                    -w - : write to standard output.



                                    -U : write packets as soon as they arrive. Don't wait until the buffer is full.



                                    Tee will write to the file, and tcpdump -r - read the packets from standard input.






                                    share|improve this answer








                                    New contributor




                                    Olivier Lasne is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
                                    Check out our Code of Conduct.










                                    So after a bit of experiment, the anwser if the following :



                                    sudo tcpdump -i enp2s0 -U -w - | tee test.pcap | tcpdump -r -


                                    -w - : write to standard output.



                                    -U : write packets as soon as they arrive. Don't wait until the buffer is full.



                                    Tee will write to the file, and tcpdump -r - read the packets from standard input.







                                    share|improve this answer








                                    New contributor




                                    Olivier Lasne is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
                                    Check out our Code of Conduct.









                                    share|improve this answer



                                    share|improve this answer






                                    New contributor




                                    Olivier Lasne is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
                                    Check out our Code of Conduct.









                                    answered 18 hours ago









                                    Olivier LasneOlivier Lasne

                                    1111




                                    1111




                                    New contributor




                                    Olivier Lasne is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
                                    Check out our Code of Conduct.





                                    New contributor





                                    Olivier Lasne is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
                                    Check out our Code of Conduct.






                                    Olivier Lasne is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
                                    Check out our Code of Conduct.




















                                        Olivier Lasne is a new contributor. Be nice, and check out our Code of Conduct.









                                        draft saved

                                        draft discarded


















                                        Olivier Lasne is a new contributor. Be nice, and check out our Code of Conduct.












                                        Olivier Lasne is a new contributor. Be nice, and check out our Code of Conduct.











                                        Olivier Lasne is a new contributor. Be nice, and check out our Code of Conduct.














                                        Thanks for contributing an answer to Server Fault!


                                        • Please be sure to answer the question. Provide details and share your research!

                                        But avoid


                                        • Asking for help, clarification, or responding to other answers.

                                        • Making statements based on opinion; back them up with references or personal experience.

                                        To learn more, see our tips on writing great answers.




                                        draft saved


                                        draft discarded














                                        StackExchange.ready(
                                        function ()
                                        StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f960405%2fhow-can-i-see-packets-while-capturing-with-tcpdump%23new-answer', 'question_page');

                                        );

                                        Post as a guest















                                        Required, but never shown





















































                                        Required, but never shown














                                        Required, but never shown












                                        Required, but never shown







                                        Required, but never shown

































                                        Required, but never shown














                                        Required, but never shown












                                        Required, but never shown







                                        Required, but never shown







                                        Popular posts from this blog

                                        Wikipedia:Vital articles Мазмуну Biography - Өмүр баян Philosophy and psychology - Философия жана психология Religion - Дин Social sciences - Коомдук илимдер Language and literature - Тил жана адабият Science - Илим Technology - Технология Arts and recreation - Искусство жана эс алуу History and geography - Тарых жана география Навигация менюсу

                                        Bruxelas-Capital Índice Historia | Composición | Situación lingüística | Clima | Cidades irmandadas | Notas | Véxase tamén | Menú de navegacióneO uso das linguas en Bruxelas e a situación do neerlandés"Rexión de Bruxelas Capital"o orixinalSitio da rexiónPáxina de Bruselas no sitio da Oficina de Promoción Turística de Valonia e BruxelasMapa Interactivo da Rexión de Bruxelas-CapitaleeWorldCat332144929079854441105155190212ID28008674080552-90000 0001 0666 3698n94104302ID540940339365017018237

                                        What should I write in an apology letter, since I have decided not to join a company after accepting an offer letterShould I keep looking after accepting a job offer?What should I do when I've been verbally told I would get an offer letter, but still haven't gotten one after 4 weeks?Do I accept an offer from a company that I am not likely to join?New job hasn't confirmed starting date and I want to give current employer as much notice as possibleHow should I address my manager in my resignation letter?HR delayed background verification, now jobless as resignedNo email communication after accepting a formal written offer. How should I phrase the call?What should I do if after receiving a verbal offer letter I am informed that my written job offer is put on hold due to some internal issues?Should I inform the current employer that I am about to resign within 1-2 weeks since I have signed the offer letter and waiting for visa?What company will do, if I send their offer letter to another company