Ask Your Question

Tshark piping issue

asked 2019-10-09 19:05:24 +0000

NetworkMiner gravatar image

updated 2019-10-09 19:06:22 +0000

hello guys, im currently in the middle of a cyber security course, and i have a little problem.

i was given a task to write a script with Tshark to sniff a live network- then i need to filter the MAC addresses, dump them to a .txt file, and then from that script to open a new terminal and use tail -f on that .txt file to see the last mac adresses that connected to the network... something like a live monitor. however, something is not working. here is my script: (im using Kali)

tshark -D

read -p " what is the desired interface for live capture? " a

touch sniffer.log

gnome-terminal -- tail -f sniffer.log

tshark -i $a -V -l | grep -i "mac" |cut -d':' -f2-5 | sort | uniq >> sniffer.log

anything i put after the grep command makes tshark show me a packet counter and nothing more.

can you please assist me?

thank you.

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2019-10-09 20:09:27 +0000

Guy Harris gravatar image

anything i put after the grep command makes tshark show me a packet counter and nothing more.

TShark itself won't show you anything on the terminal, because its output is being piped to grep.

sort, however, cannot write anything until it reads an EOF - it might be the very last line it reads from the standard input that sorts first in its output. So it won't write anything to the uniq command until the grep exits, and grep won't exit until it reads an EOF, and that won't happen until TShark exits.

Therefore, nothing will be written to sniffer.log until TShark exits, and therefore the tail -f won't print anything until TShark exits.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2019-10-09 19:05:24 +0000

Seen: 349 times

Last updated: Oct 09 '19