Wireshark · Wireshark-users: Re: [Wireshark-users] is it possible to use tcpdump to display capturign information on the linux sh

[Erik Hjelmvik <erik.hjelmvik@xxxxxxxxx>]

2012/10/29 Guy Harris <guy@xxxxxxxxxxxx>:
>
> On Oct 29, 2012, at 5:48 AM, esolve esolve <esolvepolito@xxxxxxxxx> wrote:
>
>> if I use tcpdump without "-w example.pcap"
>> the capturing information can be displayed on the linux shell window
>> but if I want to write the captured packets into a pcap file
>> the capturing information won't be displayed
>>
>> is there a way to  display capturign information on the linux shell window  while writing to pcap files?
>
> With tcpdump, no.

Actually, with tcpdump, yes:
tcpdump -i eth0 -U -w - | tee dump.pcap | tcpdump -n -r -

>
> With TShark, yes:
>
>     TShark prior to 1.8:
>
>         tshark ... -S -w example.pcap
>
>     TShark 1.8.0 and later:
>
>         tshark ... -P -w example.pcap
> ___________________________________________________________________________
> Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
> Archives:    http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>              mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe



-- 
blog: http://www.netresec.com/?page=Blog
twitter: http://twitter.com/netresec