Hey folks! I'm trying to run a tcpdump command that monitors for possible malicious traffic. I want to be able to run this on any of several remote boxes that I monitor which all have different capture interfaces. I've gotten the script to the point where it logs into the box and attempts to run the commands but the capif command is giving me problems.


If I'm ssh'ing into the sensor myself the same series of commands works fine. I could create a scriptfile on each of the sensors and have this script run that but there's a lot of them.

I believe that whats happening is that the script is attempting to run capif on the box that I'm running the script on instead of running capif on the remote box that I'm ssh'ing into.

As I said, if I put those commands in a script and run them on the remote box after having ssh'd into the box then it works just fine.

While playing around with it I found that using ssh -t -t gets rid of the
/whilemenu: line 24: capif: command not found
Pseudo-terminal will not be allocated because stdin is not a terminal.
mesg: ttyname

error and replaces it with an error:
tcgetattr: Inappropriate ioctl for device

Again, if I create the script on the remote box and either ssh to the box manually and run it or ssh via the scrip and call the 2nd script on the remote box it works as intended.

So whatever the problem is it's something to do with interactivity of ssh from what I can tell.

Okay, I fiddled some more and I think that the problem is actually that since I'm using a here document, it's reading the lines of the doc off to the remote box as if they were individual commands instead of pieces of a script.

So I guess what i need is a way to get the remote box to have the lines interpreted as a shell script instead of individual commands.

Any thoughts?

A script may indeed be a collection of commands, but I'm sure you'll agree that there are things that you can do in a shell script that simply don't work when entered as simple commands from the terminal. At least not with the same syntax. For example, variable assignment.

Adding the double quotes to the here document delimiter doesn't appear to have changed anything except to cause the
line to be interpreted as assigning the string capif to the interface variable.

That seems to be the main problem at this point, I need to get the output of capif assigned to the variable interface so that I can run tcpdump on the appropriate capture interface which varies from box to box.

This was a life saver for me.Thanks a lot cfajohnson & JASI.

Check this simple example.

#!/bin/bash
ssh -T root@192.168.0.2 << "EOF"
MYDATE=`date`
echo $MYDATE
EOF