Ok, it was my birthday yesterday so I'm hung over in a supreme way which may be the cause of this but.. # tethereal -i eth0 'port 80' > zzz Capturing on eth0 96465 8126 packets dropped This works and puts the data in to the file 'zzz' as one would expect. If I then run "grep jpg zzz" I see a load of requests, again as one would expect. And then .. # tethereal -i eth0 'port 80' | grep 'jpg' Capturing on eth0 24685 1132 packets dropped Prints out the requests with 'jpg' in them. Nothing tricky there. However, here it becomes a little more interesting.. # tethereal -i eth0 'port 80' | grep 'jpg' > zzz Capturing on eth0 24685 1132 packets dropped Leaves me with a zero byte file and a sense of stupidity. So, the output is not on stderr, but it seems by throwing a pipe->grep->redirect into the mix my data goes into /dev/null. To ensure I wasn't going mad and prove ethereal is doing something odd I tested this : # echo '/blah.jpg' | grep 'jpg' > yoyoy # cat yoyoy /blah.jpg Yep, good only pipe, grep, redirect is still working as I expected. I'm using tethereal 0.10.14 Compiled with GLib 2.6.6, with libpcap 0.8.3, with libz 1.2.2.2, with libpcre 5.0, with Net-SNMP 5.2.1.2, without ADNS. Running with libpcap version 0.8.3 on Linux 2.6.14-1.1653_FC4smp. Anybody care to point out the stupid thing I'm missing?
