On Tue, Dec 2, 2014 at 2:19 PM, Alexander Dalloz ad+lists@uni-x.org wrote:

Am 02.12.2014 um 19:05 schrieb James B. Byrne:

...

I am attempting to get a script borrowed from DJB to work on my CentOS-6.6 box. Simplified it looks like this:

tcpdump -l -n -e port 53 \ | awk '{if ($14 ~ /A.*?/) print $15}' \ | while read domain ; do echo $domain ; done ;

The sticking point is the 'while read' construct. Run just as 'tcpdum | awk' I get this:

english.stackexchange.com. www.urbandictionary.com. www.urbandictionary.com. www.urbandictionary.com. www.urbandictionary.com. api.mywot.com. a.udimg.com. a.udimg.com. fonts.googleapis.com. . . .

Run with the 'while read $domain ; do echo ' pipe nothing appears whatsoever. What am I doing wrong?

while read domain; do echo ${domain} done < <(tcpdump -l -n -e port 53 | awk '{if ($14 ~ /A.*?/) print $15}')

The "echo ${domain}" part is certainly just a simplification of a more complex command to run on the variable. Else it would be pointless as awk is printing out the domain field 15.

Alexander

If not a typo in the message, your mistake, and I do it all the time, is using

while read $domain

instead of

while read domain

Tony

On Tue, Dec 2, 2014 at 1:19 PM, Alexander Dalloz ad+lists@uni-x.org wrote:

Am 02.12.2014 um 19:05 schrieb James B. Byrne:

...

I am attempting to get a script borrowed from DJB to work on my CentOS-6.6 box. Simplified it looks like this:

tcpdump -l -n -e port 53 \ | awk '{if ($14 ~ /A.*?/) print $15}' \ | while read domain ; do echo $domain ; done ;

The sticking point is the 'while read' construct. Run just as 'tcpdum | awk' I get this:

english.stackexchange.com. www.urbandictionary.com. www.urbandictionary.com. www.urbandictionary.com. www.urbandictionary.com. api.mywot.com. a.udimg.com. a.udimg.com. fonts.googleapis.com. . . .

Run with the 'while read $domain ; do echo ' pipe nothing appears whatsoever. What am I doing wrong?

Works for me as is. You just have to wait for your pipe buffer to fill so the output is bursty.

On 2014-12-03, Hal Wigoda hal.wigoda@gmail.com wrote:

You have to do cat domain in back tiks

instead of read domain.

This is an error you can't blame on your device. domain is not a file, but a bash variable. read takes stdin (which is what the OP's snippet is doing) and populates the named variable(s) (domain in this case).

--keith