title: Greping a tcpdump with tshark
body: <p>I'm trying to program a little "dirty" website filter - e.g. an user wants to visit an erotic website (based on domain name)</p>
  
  <p>So basically, I got something like</p>
  
  <pre><code>#!/bin/bash
  sudo tshark -i any tcp port 80 or tcp port 443 -V | grep "Host.*keyword"
  </code></pre>
  
  <p>It works great but now I need to do some actions after I find something (iptables and DROPing packets...). The problem I got is that tcp dumping is still running. If I had a complete file with data, the thing I'm trying to reach is easy to solve.</p>
  
  <p>In pseudocoude, I'd like to have something like:</p>
  
  <pre><code>if (tshark and grep found something)
      iptables - drop packets 
      sleep 600 # a punishment for an user
      iptables accept packets I was dropping
  else 
      still look for a match in the tcp dump that's still running
  </code></pre>
  
  <p>Thanks for your help.</p>