Re: Watching /var/log/pflog grow

2008-11-04 Thread Matthew Seaman
cpghost wrote: How can I watch /var/log/pflog grow with tcpdump, tail -f style? This won't work: $ tail -f /var/log/pflog | tcpdump -n -s 116 -r - because tail doesn't start at the right location. Using a blocksize (-b) with tail may also not be right, because the captured packets are not

Watching /var/log/pflog grow

2008-11-04 Thread cpghost
How can I watch /var/log/pflog grow with tcpdump, tail -f style? This won't work: $ tail -f /var/log/pflog | tcpdump -n -s 116 -r - because tail doesn't start at the right location. Using a blocksize (-b) with tail may also not be right, because the captured packets are not the same size.

Re: Watching /var/log/pflog grow

2008-11-04 Thread Jeremy Chadwick
On Tue, Nov 04, 2008 at 08:13:54PM +0100, cpghost wrote: How can I watch /var/log/pflog grow with tcpdump, tail -f style? This won't work: $ tail -f /var/log/pflog | tcpdump -n -s 116 -r - because tail doesn't start at the right location. Using a blocksize (-b) with tail may also not be

Re: Watching /var/log/pflog grow

2008-11-04 Thread Sahil Tandon
cpghost [EMAIL PROTECTED] wrote: How can I watch /var/log/pflog grow with tcpdump, tail -f style? This won't work: $ tail -f /var/log/pflog | tcpdump -n -s 116 -r - because tail doesn't start at the right location. [...] I'm afraid that in the latter case, every packet will be

Re: Watching /var/log/pflog grow

2008-11-04 Thread cpghost
On Tue, Nov 04, 2008 at 07:20:42PM +, Matthew Seaman wrote: cpghost wrote: How can I watch /var/log/pflog grow with tcpdump, tail -f style? This won't work: $ tail -f /var/log/pflog | tcpdump -n -s 116 -r - because tail doesn't start at the right location. Using a blocksize

Re: Watching /var/log/pflog grow

2008-11-04 Thread cpghost
On Tue, Nov 04, 2008 at 09:22:42PM -0500, Sahil Tandon wrote: cpghost [EMAIL PROTECTED] wrote: How can I watch /var/log/pflog grow with tcpdump, tail -f style? This won't work: $ tail -f /var/log/pflog | tcpdump -n -s 116 -r - because tail doesn't start at the right location.

Re: Watching /var/log/pflog grow

2008-11-04 Thread cpghost
On Tue, Nov 04, 2008 at 05:15:57PM -0800, Jeremy Chadwick wrote: On Tue, Nov 04, 2008 at 08:13:54PM +0100, cpghost wrote: How can I watch /var/log/pflog grow with tcpdump, tail -f style? This won't work: $ tail -f /var/log/pflog | tcpdump -n -s 116 -r - because tail doesn't start at