tcpdump 停止后只显示输出

Question

我想看看我是否通过一个接口收到 ping 数据包，但 tcpdump 什么也没显示。但是，一旦我停止它（Ctrl + C），所有数据包都会出现，并且摘要看起来不错。

例如：

11:49:45.486887 IP 11.0.0.1 > 11.0.0.9: ICMP echo reply, id 13532, seq 1, length 64

这里是总结：

10 packets captured
10 packets received by filter
0 packets dropped by kernel

我通常会看到流量“实时”，但我不明白为什么现在它会被隐藏，直到我停止 tcpdump。有人可以指出我可能会发生什么吗？

Answer 1

您可能想要-lor-U选项。请参阅手册页中的信息...

   -l     Make  stdout  line buffered.  Useful if you want to see the data
          while capturing it.
          ...
          -U is similar to -l in its behavior, but it will cause output to
          be  ``packet-buffered'', so that the output is written to stdout
          at the end of each packet rather than at the end of  each  line;