0

I would like my script to run in the backround, SSH into another computer, run tcpdump, produce a pcap file and save it to my local computer. I have all of this working save for the running in the background portion.

I have looked at several solutions on Stack Overflow (example) but they don't seem to work for me. Admittedly I am a novice with bash however so it is entirely possible that I am reading them incorrectly.

ssh root@ipaddress "tcpdump -c 400000 -s 0 -U -n -w - -i eth0 not arp" &>/dev/null &disown \ > /root/Destop/BashPcap/01Bash.pcap
John Kugelman
  • 349,597
  • 67
  • 533
  • 578
Matthew Mccormick
  • 9
  • 1
  • Hi Matthew. Welcome to StackOverflow. You might want to add more information about what you mean by in the background" and spell out what, exactly, you have tried. Off the top of my head, either adding `&` at the end of your command, or running it with `nohup` should work (although your redirects would need to be handled differently). – dovetalk Apr 12 '19 at 14:00

2 Answers2

1

Check your quotation endings maybe that's the problem...

Or you can save the file remotely and download back using scp (SecureCoPy). Eg:

scp root@ipaddress:/path/to/file ~/Documents/path-where you-want-to-save.pcap
Roscrach
  • 11
  • 3
1

As far as I understood your task this is what you want: 

nohup ssh root@ipaddress "tcpdump -c 400000 -s 0 -U -n -w - -i eth0 not arp" &> /root/Destop/BashPcap/01Bash.pcap &

In simple words:

nohup - it will allow you to close your terminal and the script will continue to run

ssh ... - this is the command to execute

&> - redirect both stdout and stderr to file (Bash 4)

& - sends command to the background

Note: &> will send to the file both stdout and stderr, you need this if you want to have in your file the summary lines from tcpdump. They are written to stderr:

N packets captured
X packets received by filter
Y packets dropped by kernel

If you do not want to have these lines, then send stderr to /dev/null

nohup ssh root@ipaddress "tcpdump -c 400000 -s 0 -U -n -w - -i eth0 not arp"  2>/dev/null > /root/Destop/BashPcap/01Bash.pcap &
ISQ
  • 2,704
  • 1
  • 14
  • 8
  • I left your path "/root/Destop/" without change, but you probably meant Desktop – ISQ Apr 12 '19 at 18:12