Tshark piping issue

asked 2019-10-09 19:05:24 +0000

updated 2019-10-09 19:06:22 +0000

hello guys, im currently in the middle of a cyber security course, and i have a little problem.

i was given a task to write a script with Tshark to sniff a live network- then i need to filter the MAC addresses, dump them to a .txt file, and then from that script to open a new terminal and use tail -f on that .txt file to see the last mac adresses that connected to the network... something like a live monitor. however, something is not working. here is my script: (im using Kali)

tshark -D

read -p " what is the desired interface for live capture? " a

touch sniffer.log

gnome-terminal -- tail -f sniffer.log

tshark -i $a -V -l | grep -i "mac" |cut -d':' -f2-5 | sort | uniq >> sniffer.log

anything i put after the grep command makes tshark show me a packet counter and nothing more.

can you please assist me?

thank you.

edit retag flag offensive close merge delete

add a comment

answered 2019-10-09 20:09:27 +0000

Guy Harris
19890 ●3 ●659 ●207

anything i put after the grep command makes tshark show me a packet counter and nothing more.

TShark itself won't show you anything on the terminal, because its output is being piped to grep.

sort, however, cannot write anything until it reads an EOF - it might be the very last line it reads from the standard input that sorts first in its output. So it won't write anything to the uniq command until the grep exits, and grep won't exit until it reads an EOF, and that won't happen until TShark exits.

Therefore, nothing will be written to sniffer.log until TShark exits, and therefore the tail -f won't print anything until TShark exits.

edit flag offensive delete link

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Tshark piping issue

1 Answer

Your Answer

Question Tools

Stats

Tshark piping issue edit

1 Answer

Your Answer

Question Tools

Stats

Tshark piping issue