Today I found myself needing to save packets from tcpdump to a file but also view them on screen. I've wanted to do that in the past, but today it became more important. It was suggested to me to use two instances of tcpdump, but I thought there had to be a better way. Luckily there is.

# tcpdump -U -s 1500 -w - <bpf> |tee <file> | tcpdump -lnr -