1

For example, when I do this

sudo tcpdump | grep -E '.dev:8888|ads' | grep -v 'adsl'

ALL output is suppressed for some reason, nothing is shown if I access ads.google.com for example, it does show when I remove the grep -v, so the base command works.

However, If I try to make a file containing:

test
test2

and do grep -E 'test|test2' | grep -v 'test2' I get my desired output (test). So what is the difference when it's constantly updating, and how would I use multiple options with grep to modify the output?

DisplayName
  • 11,688
  • I know this will sound really strange butdid you try using grep -e ".dev:8888" -e ads instead of grep -E '.dev:8888|ads' ? – MelBurslan Apr 01 '16 at 21:46
  • @MelBurslan that works in the same way. Working, but when I add | grep -v 'adsl' no output is shown. – DisplayName Apr 01 '16 at 21:50

1 Answers1

6

You may have a problem with line-buffering here. Instruct tcpdump and the intermediate grep command(s) to line-buffer their outputs as follows:

sudo tcpdump -l | grep --line-buffered -E '.dev:8888|ads' | grep -v 'adsl'

See also Turn off buffering in pipe for general solutions when these command options are not available.

Community
  • 1
Guido
  • 4,114