Question

I am trying to pipe tshark output to awk. The tshark command works fine on its own, and when piped to other programs such as cat, it works fine (real time printing of output). However, when piped to awk, it hangs and nothing happens.

sudo tshark -i eth0 -l -f "tcp" -R 'http.request.method=="GET"' -T fields -e ip.src -e ip.dst -e 
tcp.srcport -e tcp.dstport -e tcp.seq -e tcp.ack | awk '{printf("mz -A %s -B %s -tcp \"s=%s sp=%s 
dp=%s\"\n", $2, $1, $5, $4, $3)}'

Here is a simplier version:

sudo tshark -i eth0 -f "tcp" -R 'http.request.method=="GET"' | awk '{print $0}'

And to compare, the following works fine (although is not very useful):

sudo tshark -i eth0 -f "tcp" -R 'http.request.method=="GET"' | cat

Thanks in advance.

Answer 1

Per our previous messages in comments, maybe it will work to force closing the input and emitting a linefeed.

sudo tshark -i eth0 -f "tcp" -R 'http.request.method=="GET"' ...... \
| {
    awk '{print $0}'
    printf "\n"
  }

Note, no pipe between awk and printf.

I hope this helps.