How to Break Up Large tcpdump Files

Posted by Kyle Brandt on Server Fault See other posts from Server Fault or by Kyle Brandt
Published on 2010-03-18T11:59:31Z Indexed on 2010/03/18 12:01 UTC
Read the original article Hit count: 441

Filed under:

tcpdump

Is there something that can break up tcpdump file after the captuure and make sure the breaks are on the border of packet data?

Like -C but after the fact.

Related posts about tcpdump

Packet loss rate with iperf and tcpdump

as seen on Server Fault - Search for 'Server Fault'
I tested a line for its link quality with iperf. The measured speed (UDP port 9005) was 96Mbps, which is fine, because both servers are connected with 100Mbps to the internet. On the other hand the datagram loss rate was shown to be 3.3-3.7%, which I found a little too much. Using a high-speed transfer… >>> More
tcpdump filter that excludes private ip traffic

as seen on Server Fault - Search for 'Server Fault'
For a generic filter to exclude all traffic in my dump that is between private IP address, I came up with the following: sudo tcpdump -n ' (not ( (src net 172.16.0.0/20 or src net 10.0.0.0/8 or src net 192.168.0.0/16) and (dst net 172.16.0.0/20 or dst net 10.0.0.0/8 or dst… >>> More
How to Break Up Large tcpdump Files

as seen on Server Fault - Search for 'Server Fault'
Is there something that can break up tcpdump file after the captuure and make sure the breaks are on the border of packet data? Like -C but after the fact. >>> More
tcpdump on dd-wrt router

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm trying to capture packets from two devices on my network. I have tcpdump installed on my dd-wrt router and working correctly. However, the only packets I capture are broadcast packets when using a tcpdump statement that states only those two devices ./tcpdump -w /tmp/capture.pcap dst 192.168… >>> More
How can I log all traffic with its exact length?

as seen on Server Fault - Search for 'Server Fault'
I want to process all packets with their size going through our gateway server (running Debian 4.0). My idea is to use tcpdump, but I have two questions. The command I'm currently thinking of is tcpdump -i iface -n -t -q. Is it guaranteed that tcpdump will process all packets? What happens if… >>> More

Developer IT

How to Break Up Large tcpdump Files - Developer IT

How to Break Up Large tcpdump Files

tcpdump

Related posts about tcpdump

Packet loss rate with iperf and tcpdump

tcpdump filter that excludes private ip traffic

How to Break Up Large tcpdump Files

tcpdump on dd-wrt router

How can I log all traffic with its exact length?

Categories cloud