Re: Watching /var/log/pflog grow

2008-11-04 Thread cpghost
On Tue, Nov 04, 2008 at 05:15:57PM -0800, Jeremy Chadwick wrote: > On Tue, Nov 04, 2008 at 08:13:54PM +0100, cpghost wrote: > > How can I watch /var/log/pflog grow with tcpdump, "tail -f" style? > > > > This won't work: > > $ tail -f /var/log/pflog | tcpdump -n -s 116 -r - > > because tail doesn

Re: Watching /var/log/pflog grow

2008-11-04 Thread cpghost
On Tue, Nov 04, 2008 at 09:22:42PM -0500, Sahil Tandon wrote: > cpghost <[EMAIL PROTECTED]> wrote: > > > How can I watch /var/log/pflog grow with tcpdump, "tail -f" style? > > > > This won't work: > > $ tail -f /var/log/pflog | tcpdump -n -s 116 -r - > > because tail doesn't start at the right

Re: Watching /var/log/pflog grow

2008-11-04 Thread cpghost
On Tue, Nov 04, 2008 at 07:20:42PM +, Matthew Seaman wrote: > cpghost wrote: > > How can I watch /var/log/pflog grow with tcpdump, "tail -f" style? > > > > This won't work: > > $ tail -f /var/log/pflog | tcpdump -n -s 116 -r - > > because tail doesn't start at the right location. > > > > Us

Re: Watching /var/log/pflog grow

2008-11-04 Thread Sahil Tandon
cpghost <[EMAIL PROTECTED]> wrote: > How can I watch /var/log/pflog grow with tcpdump, "tail -f" style? > > This won't work: > $ tail -f /var/log/pflog | tcpdump -n -s 116 -r - > because tail doesn't start at the right location. [...] > I'm afraid that in the latter case, every packet will be

Re: Watching /var/log/pflog grow

2008-11-04 Thread Jeremy Chadwick
On Tue, Nov 04, 2008 at 08:13:54PM +0100, cpghost wrote: > How can I watch /var/log/pflog grow with tcpdump, "tail -f" style? > > This won't work: > $ tail -f /var/log/pflog | tcpdump -n -s 116 -r - > because tail doesn't start at the right location. > > Using a blocksize (-b) with tail may als

Re: Watching /var/log/pflog grow

2008-11-04 Thread Matthew Seaman
cpghost wrote: How can I watch /var/log/pflog grow with tcpdump, "tail -f" style? This won't work: $ tail -f /var/log/pflog | tcpdump -n -s 116 -r - because tail doesn't start at the right location. Using a blocksize (-b) with tail may also not be right, because the captured packets are not t