tcpdump output to file not working
I'm trying to write the results of tcpdump to a text file. I am not interested in saving a pcap file to use later, I just need exactly what tcpdump returns in plain text (the ips and timestamps of connections).
I tried this but it doesn't seem to be working:
tcpdump port 5000 and '(tcp-syn)!=0' > network_output.txt
This command should save to the textfile but instead it echo's the output right in the termial as if I left the > network_output.txt off.
linux bash
migrated from stackoverflow.com Jun 7 '13 at 17:57
This question came from our site for professional and enthusiast programmers.
|
show 2 more comments
I'm trying to write the results of tcpdump to a text file. I am not interested in saving a pcap file to use later, I just need exactly what tcpdump returns in plain text (the ips and timestamps of connections).
I tried this but it doesn't seem to be working:
tcpdump port 5000 and '(tcp-syn)!=0' > network_output.txt
This command should save to the textfile but instead it echo's the output right in the termial as if I left the > network_output.txt off.
linux bash
migrated from stackoverflow.com Jun 7 '13 at 17:57
This question came from our site for professional and enthusiast programmers.
What did you mean byand '(tcp-syn)!=0'? Should it be a comparison, then you forgot to make it a var:and [[ ${tcp-syn} -ne 0 ]].
– Rubens
Jun 7 '13 at 16:58
I'm not sure. I didn't know what it did either but a friend told me to use it.
– tajonny07
Jun 7 '13 at 17:00
Then, why not justtcpdump port 5000 > ...?
– Rubens
Jun 7 '13 at 17:01
Well sure I can, but its still not writing to the file.
– tajonny07
Jun 7 '13 at 17:05
2
Usetcpdump port 5000 &> network_output.txt. This shall redirect both stdout and stderr to your file. Andalso, you seem to be runningtcpdumpwith incorrect arguments. Useman tcpdumpfor reference.
– Rubens
Jun 7 '13 at 17:10
|
show 2 more comments
I'm trying to write the results of tcpdump to a text file. I am not interested in saving a pcap file to use later, I just need exactly what tcpdump returns in plain text (the ips and timestamps of connections).
I tried this but it doesn't seem to be working:
tcpdump port 5000 and '(tcp-syn)!=0' > network_output.txt
This command should save to the textfile but instead it echo's the output right in the termial as if I left the > network_output.txt off.
linux bash
I'm trying to write the results of tcpdump to a text file. I am not interested in saving a pcap file to use later, I just need exactly what tcpdump returns in plain text (the ips and timestamps of connections).
I tried this but it doesn't seem to be working:
tcpdump port 5000 and '(tcp-syn)!=0' > network_output.txt
This command should save to the textfile but instead it echo's the output right in the termial as if I left the > network_output.txt off.
linux bash
linux bash
asked Jun 7 '13 at 16:52
tajonny07
migrated from stackoverflow.com Jun 7 '13 at 17:57
This question came from our site for professional and enthusiast programmers.
migrated from stackoverflow.com Jun 7 '13 at 17:57
This question came from our site for professional and enthusiast programmers.
What did you mean byand '(tcp-syn)!=0'? Should it be a comparison, then you forgot to make it a var:and [[ ${tcp-syn} -ne 0 ]].
– Rubens
Jun 7 '13 at 16:58
I'm not sure. I didn't know what it did either but a friend told me to use it.
– tajonny07
Jun 7 '13 at 17:00
Then, why not justtcpdump port 5000 > ...?
– Rubens
Jun 7 '13 at 17:01
Well sure I can, but its still not writing to the file.
– tajonny07
Jun 7 '13 at 17:05
2
Usetcpdump port 5000 &> network_output.txt. This shall redirect both stdout and stderr to your file. Andalso, you seem to be runningtcpdumpwith incorrect arguments. Useman tcpdumpfor reference.
– Rubens
Jun 7 '13 at 17:10
|
show 2 more comments
What did you mean byand '(tcp-syn)!=0'? Should it be a comparison, then you forgot to make it a var:and [[ ${tcp-syn} -ne 0 ]].
– Rubens
Jun 7 '13 at 16:58
I'm not sure. I didn't know what it did either but a friend told me to use it.
– tajonny07
Jun 7 '13 at 17:00
Then, why not justtcpdump port 5000 > ...?
– Rubens
Jun 7 '13 at 17:01
Well sure I can, but its still not writing to the file.
– tajonny07
Jun 7 '13 at 17:05
2
Usetcpdump port 5000 &> network_output.txt. This shall redirect both stdout and stderr to your file. Andalso, you seem to be runningtcpdumpwith incorrect arguments. Useman tcpdumpfor reference.
– Rubens
Jun 7 '13 at 17:10
What did you mean by
and '(tcp-syn)!=0'? Should it be a comparison, then you forgot to make it a var: and [[ ${tcp-syn} -ne 0 ]].– Rubens
Jun 7 '13 at 16:58
What did you mean by
and '(tcp-syn)!=0'? Should it be a comparison, then you forgot to make it a var: and [[ ${tcp-syn} -ne 0 ]].– Rubens
Jun 7 '13 at 16:58
I'm not sure. I didn't know what it did either but a friend told me to use it.
– tajonny07
Jun 7 '13 at 17:00
I'm not sure. I didn't know what it did either but a friend told me to use it.
– tajonny07
Jun 7 '13 at 17:00
Then, why not just
tcpdump port 5000 > ...?– Rubens
Jun 7 '13 at 17:01
Then, why not just
tcpdump port 5000 > ...?– Rubens
Jun 7 '13 at 17:01
Well sure I can, but its still not writing to the file.
– tajonny07
Jun 7 '13 at 17:05
Well sure I can, but its still not writing to the file.
– tajonny07
Jun 7 '13 at 17:05
2
2
Use
tcpdump port 5000 &> network_output.txt. This shall redirect both stdout and stderr to your file. Andalso, you seem to be running tcpdump with incorrect arguments. Use man tcpdump for reference.– Rubens
Jun 7 '13 at 17:10
Use
tcpdump port 5000 &> network_output.txt. This shall redirect both stdout and stderr to your file. Andalso, you seem to be running tcpdump with incorrect arguments. Use man tcpdump for reference.– Rubens
Jun 7 '13 at 17:10
|
show 2 more comments
1 Answer
1
active
oldest
votes
What operating system and shell are you using? (Your command works fine for me on my system.)
Try tcpdump port 5000 and '(tcp-syn)!=0' &> network_output.txt (notice &> instead of >) and see if that does what you want. It combines the Standard Output with the Error Output into one file. Although it's called the Error Output, that second output stream is often used for output meant for an interactive terminal such as progress information.
If that doesn't work, try:
script network_output.txt
tcpdump port 5000 and '(tcp-syn)!=0'
then Ctrl-C to quit tcpdump and Ctrl-D to exit script. You will get extra junk in the file but it will have all the terminal output as well.
answered Jun 7 '13 at 17:22
Old ProOld Pro
1,544817
Thanks for the reply. This is interesting. It 'did' work or so I thought, as the 'listening on port 5000...' got written to the text file, but when I make a connection the '0.0.0.0 has connected ..' that its supposed to be also written isnt. when I do the command by iteslf I have many lines coming up as clients connect, but it doesn't seem to be doing that when I write it to the file.. PS I'm using CentOS 5.9
– tajonny07
Jun 7 '13 at 17:25
Try usingscript.
– Old Pro
Jun 7 '13 at 17:32
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f605021%2ftcpdump-output-to-file-not-working%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
What operating system and shell are you using? (Your command works fine for me on my system.)
Try tcpdump port 5000 and '(tcp-syn)!=0' &> network_output.txt (notice &> instead of >) and see if that does what you want. It combines the Standard Output with the Error Output into one file. Although it's called the Error Output, that second output stream is often used for output meant for an interactive terminal such as progress information.
If that doesn't work, try:
script network_output.txt
tcpdump port 5000 and '(tcp-syn)!=0'
then Ctrl-C to quit tcpdump and Ctrl-D to exit script. You will get extra junk in the file but it will have all the terminal output as well.
answered Jun 7 '13 at 17:22
Old ProOld Pro
1,544817
Thanks for the reply. This is interesting. It 'did' work or so I thought, as the 'listening on port 5000...' got written to the text file, but when I make a connection the '0.0.0.0 has connected ..' that its supposed to be also written isnt. when I do the command by iteslf I have many lines coming up as clients connect, but it doesn't seem to be doing that when I write it to the file.. PS I'm using CentOS 5.9
– tajonny07
Jun 7 '13 at 17:25
Try usingscript.
– Old Pro
Jun 7 '13 at 17:32
add a comment |
What operating system and shell are you using? (Your command works fine for me on my system.)
Try tcpdump port 5000 and '(tcp-syn)!=0' &> network_output.txt (notice &> instead of >) and see if that does what you want. It combines the Standard Output with the Error Output into one file. Although it's called the Error Output, that second output stream is often used for output meant for an interactive terminal such as progress information.
If that doesn't work, try:
script network_output.txt
tcpdump port 5000 and '(tcp-syn)!=0'
then Ctrl-C to quit tcpdump and Ctrl-D to exit script. You will get extra junk in the file but it will have all the terminal output as well.
answered Jun 7 '13 at 17:22
Old ProOld Pro
1,544817
Thanks for the reply. This is interesting. It 'did' work or so I thought, as the 'listening on port 5000...' got written to the text file, but when I make a connection the '0.0.0.0 has connected ..' that its supposed to be also written isnt. when I do the command by iteslf I have many lines coming up as clients connect, but it doesn't seem to be doing that when I write it to the file.. PS I'm using CentOS 5.9
– tajonny07
Jun 7 '13 at 17:25
Try usingscript.
– Old Pro
Jun 7 '13 at 17:32
add a comment |
What operating system and shell are you using? (Your command works fine for me on my system.)
Try tcpdump port 5000 and '(tcp-syn)!=0' &> network_output.txt (notice &> instead of >) and see if that does what you want. It combines the Standard Output with the Error Output into one file. Although it's called the Error Output, that second output stream is often used for output meant for an interactive terminal such as progress information.
If that doesn't work, try:
script network_output.txt
tcpdump port 5000 and '(tcp-syn)!=0'
then Ctrl-C to quit tcpdump and Ctrl-D to exit script. You will get extra junk in the file but it will have all the terminal output as well.
answered Jun 7 '13 at 17:22
Old ProOld Pro
1,544817
What operating system and shell are you using? (Your command works fine for me on my system.)
Try tcpdump port 5000 and '(tcp-syn)!=0' &> network_output.txt (notice &> instead of >) and see if that does what you want. It combines the Standard Output with the Error Output into one file. Although it's called the Error Output, that second output stream is often used for output meant for an interactive terminal such as progress information.
If that doesn't work, try:
script network_output.txt
tcpdump port 5000 and '(tcp-syn)!=0'
then Ctrl-C to quit tcpdump and Ctrl-D to exit script. You will get extra junk in the file but it will have all the terminal output as well.
answered Jun 7 '13 at 17:22
Old ProOld Pro
1,544817
answered Jun 7 '13 at 17:22
Old ProOld Pro
1,544817
answered Jun 7 '13 at 17:22
Old ProOld Pro
1,544817
answered Jun 7 '13 at 17:22
Old ProOld Pro
1,544817
1,544817
Thanks for the reply. This is interesting. It 'did' work or so I thought, as the 'listening on port 5000...' got written to the text file, but when I make a connection the '0.0.0.0 has connected ..' that its supposed to be also written isnt. when I do the command by iteslf I have many lines coming up as clients connect, but it doesn't seem to be doing that when I write it to the file.. PS I'm using CentOS 5.9
– tajonny07
Jun 7 '13 at 17:25
Try usingscript.
– Old Pro
Jun 7 '13 at 17:32
add a comment |
Thanks for the reply. This is interesting. It 'did' work or so I thought, as the 'listening on port 5000...' got written to the text file, but when I make a connection the '0.0.0.0 has connected ..' that its supposed to be also written isnt. when I do the command by iteslf I have many lines coming up as clients connect, but it doesn't seem to be doing that when I write it to the file.. PS I'm using CentOS 5.9
– tajonny07
Jun 7 '13 at 17:25
Try usingscript.
– Old Pro
Jun 7 '13 at 17:32
Thanks for the reply. This is interesting. It 'did' work or so I thought, as the 'listening on port 5000...' got written to the text file, but when I make a connection the '0.0.0.0 has connected ..' that its supposed to be also written isnt. when I do the command by iteslf I have many lines coming up as clients connect, but it doesn't seem to be doing that when I write it to the file.. PS I'm using CentOS 5.9
– tajonny07
Jun 7 '13 at 17:25
Thanks for the reply. This is interesting. It 'did' work or so I thought, as the 'listening on port 5000...' got written to the text file, but when I make a connection the '0.0.0.0 has connected ..' that its supposed to be also written isnt. when I do the command by iteslf I have many lines coming up as clients connect, but it doesn't seem to be doing that when I write it to the file.. PS I'm using CentOS 5.9
– tajonny07
Jun 7 '13 at 17:25
Try using
script.– Old Pro
Jun 7 '13 at 17:32
Try using
script.– Old Pro
Jun 7 '13 at 17:32
add a comment |
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f605021%2ftcpdump-output-to-file-not-working%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
What did you mean by
and '(tcp-syn)!=0'? Should it be a comparison, then you forgot to make it a var:and [[ ${tcp-syn} -ne 0 ]].– Rubens
Jun 7 '13 at 16:58
I'm not sure. I didn't know what it did either but a friend told me to use it.
– tajonny07
Jun 7 '13 at 17:00
Then, why not just
tcpdump port 5000 > ...?– Rubens
Jun 7 '13 at 17:01
Well sure I can, but its still not writing to the file.
– tajonny07
Jun 7 '13 at 17:05
2
Use
tcpdump port 5000 &> network_output.txt. This shall redirect both stdout and stderr to your file. Andalso, you seem to be runningtcpdumpwith incorrect arguments. Useman tcpdumpfor reference.– Rubens
Jun 7 '13 at 17:10