I'm trying to mirror dns queries generated by TCPDUMP filter and replay them with dig or any other utility

Question

I'm not a very experienced script writer at all. I did find some useful hints in generating an stdout from tcpdump that generates a live feed if you will which is what I want, the problem is handling the out output and generate dig/DNS queries against another DNS server for a lab.

Give me the output I'm looking for:

tcpdump -lvi any "udp port 53" 2>/dev/null|grep -E 'A\?'|awk '{print $(NF-1)}'

I've tried this just testing adding the output into an array but I get nothing

declare -a testarr
testarr=( $(tcpdump -lvi any "udp port 53" 2>/dev/null|grep -E 'A\?'|awk '{print $(NF-1)}') )
echo ${testarr[@]}

I've also tried

dig @1.1.1.1 $(tcpdump -lvi any "udp port 53" 2>/dev/null|grep -E 'A\?'|awk '{print $(NF-1)}')

Any help is appreciated.

Answer 1

Problem is that $() returns only when tcpdump exits, but it will never exit in your case. You can redirect output to xargs command - it can run dig before tcpdump exits

example code:

tcpdump -nvi any "udp port 53" 2>/dev/null|awk '/A\?/{print $(NF-1);fflush()}' | xargs -n 1 dig @1.1.1.1 

Also note, that awk output can be buffered, so you should flush output in your awk program.