TCPDUMP to MySQL

marcos egatz · 04-13-2012, 04:27 PM

Hi guys,
I'm currently dealing with the dilemma of whether if is worthwhile to pipe the output of "tcpdump" command into a simple perl script, which will indeed do a select-query from myslq. Afterwards ( as a result from the previous logic) there's gonna be an insertion into a table (in the same mysql).
Have anybody tried/heard this as an effective approach? I need some advice because I haven't found much evidence on this topic.

Regards

acid_kewpie · 04-16-2012, 02:07 AM

seems like a bizarre and contrived thing to want to do, but you'd given no reason as to why you'd want to for context.

Nothing to do with networking. Moved to Linux - Software

chrism01 · 04-16-2012, 07:48 PM

As acid_kewpie implied, it'd help if you explained a bit more about what you want to do and why.
For example, is this going to be an ongoing stream of tcpdump, or could you just dump to a file, then read that; you have to consider if the Perl prog will be able keep up with the incoming data flow.

marcos egatz · 04-18-2012, 05:00 PM

Chris,
As you've mentioned, streaming the output of tcpdump into a file plus using a Perl script, proved to be a suitable solution, which solved my requirement. But going back to the initial approach, it might be great if tcpdump had some way to store its output in a database just for logging purposes. But thinking a little bit in the aim of tcpdump itself, maybe it wasn't build with this usage in mind, because there are other better ways to do this (e.g. perl script).

Thanks.