title: how to read and automatically analyse a pcap from STDIN
body: <p>I'am about to build an automatic intrusion detection system (IDS) behind my FritzBox Router in my home LAN.</p>
  
  <p>I'm using a Raspberry Pi with <strong>Raspbian Jessie</strong>, but any dist would be ok.</p>
  
  <p>After some searches and tryouts I found <strong>ntop</strong> (<strong>ntopng</strong> to be honest, but I guess my questions aims to any version).</p>
  
  <p><strong>ntop</strong> can capture network traffic on its own, but thats <strong>not</strong> what I want because I want to get all the traffic without putting the Pi between the devices or let him act as a gateway (for performance reasons). Fortunately <a href="http://www.wehavemorefun.de/fritzbox/IP-Pakete_mitschneiden" rel="nofollow">my FritzBox OS has a function to simulate a mirror port</a>. You can download a .pcap which is continously written in realtime. I do it with a script from this link.</p>
  
  <p>The problem is that I can't pipe the wget download to ntop like I could do it with e.g. tshark.</p>
  
  <p>I'm looking for:</p>
  
  <pre><code>wget -O - http://fritz.box/never_ending.pcap | ntopng -f -
  </code></pre>
  
  <p>While this works fine:</p>
  
  <pre><code>wget -O - http://fritz.box/never_ending.pcap | tshark -i -
  </code></pre>
  
  <p>Suggestions of other analyzing software is ok (if pretty enough ;) ) but I want to use the FritzBox-pcap-thing...</p>
  
  <p>Thanks for saving another day of mine :)</p>
  
  <p><strong>Edit:</strong>
  So I'm comming to this approaches:</p>
  
  <ul>
  <li>Make chunks of pcaps an run a script to analyse every pcap after another. <em>Problem</em> ntop do not merge the results, and I could get a storage problem if traffic running hot</li>
  <li>Pipe <code>wget</code> to <code>tshark</code> and overwrite one pcap every time. Then analyse it with ntop. <em>Problem</em> again, the storage</li>
  <li>Pipe <code>wget</code> to <code>tshark</code> cut some information out and store them to a database. <em>Problem</em> which info should I store and what programm likes dbs more than pcaps ?</li>
  </ul>