1

I am working on a bash script that captures beacon frame packets (without bad fcs) and output them in a preferred format, but I am having problem redirecting the outptut to a file.

This is my command line when I am redirecting to a file called temp

tcpdump -I -i mon0 -vv 2>/dev/null|awk -F ',| ' 'BEGIN{printf "%-10s %-25s%-10s\n","OPTION NO.","ESSID(Beacon Frames)","CHANNEL NO."};$0~/Beacon/{for(i=1;i<=NF;++i){if(($i~/^\([^^]+\)$/) && !($i in arr) && ($0~/CH:/) && !($0~/tsft bad-fcs/)){NR=++c;arr[$i]=1;gsub(/\(|\)/,"",$i);printf("%-10s %-25s",NR,$i);for(x=1;x<=NF;++x){if($x~/^CH:/){print $x " "$(x+1) "\tHit Ctrl+C to stop scan"}}}}}' >> temp

The command line above works fine in a terminal when I am not redirecting to a file (the output is shown). When I am redirecting to a file, I am seeing the file exist with no output.

I tried the following

1.Pipe the command line output like tee -a temp (to output to stdout and file)

example

tcpdump -I -i mon0 -vv 2>/dev/null|awk -F ',| ' 'BEGIN{printf "%-10s %-25s%-10s\n","OPTION NO.","ESSID(Beacon Frames)","CHANNEL NO."};$0~/Beacon/{for(i=1;i<=NF;++i){if(($i~/^\([^^]+\)$/) && !($i in arr) && ($0~/CH:/) && !($0~/tsft bad-fcs/)){NR=++c;arr[$i]=1;gsub(/\(|\)/,"",$i);printf("%-10s %-25s",NR,$i);for(x=1;x<=NF;++x){if($x~/^CH:/){print $x " "$(x+1) "\tHit Ctrl+C to stop scan"}}}}}'|tee -a temp
  1. I tried

    exec > temp command line above

Can this be a buffering issue since packet capturing is rapid?

How can the results of the above command line be redirected to a file?

Note: mon0 in the command line represents the monitor interface I started on my wireless adapter using airmon-ng

edit: the breakdown of the codes are as follows

BEGIN {
    FS=",| "
    printf "%-10s %-25s%-10s\n","OPTION NO.","ESSID(Beacon Frames)","CHANNEL NO."
}
$0~/Beacon/ {
    for(i=1;i<=NF;++i) {
        if(($i~/^\([^^]+\)$/) && !($i in arr) && ($0~/CH:/) && !($0~/tsft bad-fcs/)) {
            NR=++c
            arr[$i]=1
            gsub(/\(|\)/,"",$i)
            printf("%-10s %-25s",NR,$i)
            for(x=1;x<=NF;++x) {
                if($x~/^CH:/) {
                    print $x " "$(x+1) "\tHit Ctrl+C to stop scan"
                }
            }
        }
    }
}

As i mentioned the codes work fine..it is just the redirection issue..do offer improvements to the code if needed.

Ed Morton
  • 188,023
  • 17
  • 78
  • 185
repzero
  • 8,254
  • 2
  • 18
  • 40
  • 1
    Isn't it obvious that the code doesn't suite for a one-liner? Use `awk -f script.awk` and post `script.awk` in your question - properly indented. – hek2mgl Feb 23 '15 at 22:13
  • Yes I know..My mistake here..but the script is very large..so I tried some one-liner codes (my apologies) – repzero Feb 23 '15 at 22:15
  • Just change it. It would be probably an upvote instead of a downvote. – hek2mgl Feb 23 '15 at 22:15
  • okay give me a second – repzero Feb 23 '15 at 22:16
  • possible duplicate http://stackoverflow.com/questions/302152/awk-redirecting-script-output-from-script-to-another-file-with-dynamic-name?rq=1 – theWanderer4865 Feb 23 '15 at 22:18
  • @ hek2mgl..internet issues on my side...however i edited my answer for a clearer description of the codes....thank you – repzero Feb 23 '15 at 22:55
  • @EdMorton Nope..I have tried `tcpdump... | awk '{print}' > file`. It works fine (it redirect output to file).. – repzero Feb 23 '15 at 22:57
  • 1
    @EdMorton I like that kind of debugging :) .. You might blame me why I not use Google but are there debuggers for awk and have you used some? – hek2mgl Feb 23 '15 at 23:03
  • I tried eliminating the codes piece by piece for hours to see what the issue was (even skipped lunch and breakfast)...`NR=++c` ...I change the records because..there are so many packets flowing out of the screen..once I find the packet that has a beacon frame, I output the packet and a add number to it (like a numbering counter). – repzero Feb 23 '15 at 23:06
  • @EdMorton..okay I will make this correction with the counter in my script – repzero Feb 23 '15 at 23:20
  • Please, for this question, just reduce your script to the smallest possible example that demonstrates the problem. – Ed Morton Feb 23 '15 at 23:21

2 Answers2

0

May not be the answer and i haven't worked with bash in forever but possibly try sending it to a text file. temp may be treated as a directory. Instead try exec > temp.txt

Ray
  • 1,134
  • 10
  • 27
0

After a bit of reading on awk and gawk..I came across a very interesting topic on buffering behaviour in one of my text.This solved my problem..I changed the buffering behaviour of awk using the following

fflush("") ==> gawk and newer versions of awk

or

system("")==> older versions of awk

This forces awk to flush its output immediately for every input line.

I tried each of the aforementioned functions in my command line and my output was immediately redirected to my file temp.

repzero
  • 8,254
  • 2
  • 18
  • 40