You're sample of forks without & is very close to how I solved my problem, based on your original reply. I used Proc::ProcessTable to get the pid associated with snoop.

The following is a mock-up of pstree.

sshd,30982
  --bash,30983
      --su,31002
          --bash,31003
              --my.pl,6893 ./my.pl debug
                  --sh,6934 -c ...
                       --tcpdump,6935
                  --my.pl,6933 ./my.pl debug

[download]

I achieved these results by using open, as in "open, $snoop, $snoop_cmd". Then, while $snoop is running, I start a counter, and test whether the actual snoop pid is running.

while ( $counter < 31 ) {
        my $snoop_running = 1;
        for my $p ( @{ $ps->table } ) {
            if (   ( $p->pid == $snoop_pid )
                && ( $p->ppid == getpgrp($fork_pid) )
                && ( ( $p->cmndline ) =~ '$snoop_cmd' ) )
            {
                $snoop_running = 0;
                print "packet capture still running (", $p->pid, ") ",
                  $p->cmndline, "\n"
                  if (( $debug eq 0 ) && (( $p->cmndline ) =~ '$snoop_
+cmd' ));
            }
        }
        if ( $snoop_running == 1 ) {

            #snoop must have finished already
            for my $p ( @{ $ps->table } ) {
                kill 9, ( $p->pid ) if ( $p->ppid == getpgrp($fork_pid
+) );
            }
            last;
        }
$counter++;
sleep 1;

[download]

I used this timer method, because at certain check points; 5, 10, and 20 seconds; I wanted to execute additional system commands, but I did not want to execute any if my snoop had already completed. Next, I kill the fork once packet capture is done. That level of fine pid control is admittedly overly fine, and not for everyone.

I don't think I would have figured this out, without your initial reply. Thank you very much!

In reply to Re^2: forking, waiting, and killing child pids by sinmissing
in thread forking, waiting, and killing child pids by sinmissing

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.