Bash script that will replace only the first line

Question

I want to extract the timestamp of the packets using tcpdump and put it into a file, in such a way that the latest timestamp replaces the first line (which either is empty or contains the the timestamp of the second-last packet). Its necessary that the file should only have a 1 line entry ie. the timestamp of the latest packet.

This is what I did:

sudo tcpdump -i eth0 -l | cut -d . -f1 >  test.txt

cat test.txt
16:08:04
16:08:05
16:08:05
16:08:05
16:08:05
16:08:05
16:08:05
16:08:05

But what I want is only the latest timestamp:

cat test.txt
16:08:05

Any Ideas?

Jessada Thutkawkorapin · Accepted Answer · 2014-04-05 12:14:25Z

2

From what I've tested, it looks like your script will run forever and you may need to see the last packet in another process, isn't it?

$ cat test.txt

16:08:04
16:08:05
16:08:05
16:08:05
16:08:05
16:08:05
16:08:05
16:08:05

If you only want the latest packet (i.e. the last line), please try

$ tail -1 test.txt

16:08:05

if you want to see the latest packet together with the rest, please try

$ tail -1 test.txt > tmp_out; cat test.txt >> tmp_out; cat tmp_out

16:08:05
16:08:04
16:08:05
16:08:05
16:08:05
16:08:05
16:08:05
16:08:05
16:08:05

edited Apr 5, 2014 at 12:14

answered Apr 5, 2014 at 10:58

Jessada Thutkawkorapin

1,3463 gold badges16 silver badges32 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

user3465593 Over a year ago

not what I'm looking for. I'm piping the output of tcpdump to the file, but I only want it to replace the first line with the latest timestamp (this is because i have space constraints)

suspectus Over a year ago

replace the first line - that's not what your question asks for. Please update your post.

anubhava · Accepted Answer · 2014-04-05 12:30:00Z

0

Using awk you can do:

sudo tcpdump -i en0 -l -c 5 2>/dev/null | awk -F'\\.' '$1~/^[012][0-9]:/{p=$1} 
   END{print p > "output"}'

cat output
08:27:51

This will get max timestamp and store it in file called output.

answered Apr 5, 2014 at 12:30

anubhava

790k67 gold badges603 silver badges671 bronze badges

Collectives™ on Stack Overflow

Bash script that will replace only the first line

2 Answers 2

2 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related