Best way to filter real time data stream?

From: Herb T (oth3ll0_at_hotmail.com)
Date: 04/30/05 

Date: 30 Apr 2005 10:16:38 -0700

Greetings,
I was searching for a way to filter out keep-alive traffic and data
arriving from a specific ip addr (e.g. chat server) for a continuous
stream of network data. I started with grep, but the problem I was
having when grep was piped through grep, real time traffic seemed to
buffer the data stream. Information updates happened after a some
number of characters accumulated. For example,

ht@host:~$ tcpdump -i eth0 | grep -v keep-alive-traffic | grep -v
chat-server
...

Can you recommend a better way than two levels of pipe ('|')? I had
thought maybe sed, or combining into a single egrep expression?
Thanks,
-HT

Relevant Pages

  • Re: Best way to filter real time data stream?
    ... > arriving from a specific ip addr (e.g. chat server) for a continuous ... I started with grep, ... > buffer the data stream. ...
    (comp.os.linux.misc)
  • Re: Could UNIX I/O be Made Type-Safe?
    ... He's defining grep to specifically accept and produce ... whatever stream format from it, adding type information back in as ... Where "arbtext2xml" fails if its input is not valid. ... generalisation would be to let them be "sequences of things". ...
    (comp.unix.programmer)
  • Re: Forcing fflush on a pipeline?
    ... > I can pipe stdout to various Linux tools to extract ... But if the output of the stream is ... but this is apparently not a standard grep option for other ... and I don't see a similar option for other Linux tools. ...
    (comp.os.linux.misc)
  • Re: Could UNIX I/O be Made Type-Safe?
    ... its "acceptable input type" signature would be highly generic, ... the time the filtered data arrived at program2; ... of the data would be obscured by the grep in the middle. ... whatever stream format from it, adding type information back in as ...
    (comp.unix.programmer)
  • Re: Best way to filter real time data stream?
    ... >> stream of network data. ... I started with grep, ... or combining into a single egrep expression? ...
    (comp.os.linux.misc)