LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 01-22-2013, 05:54 AM   #1
eeluve
Member
 
Registered: Nov 2011
Location: Russia, SPb
Distribution: all of 'em
Posts: 49

Rep: Reputation: Disabled
tcpdump into a file correctly


What I do want is something like:
Code:
tcpdump -i igb0 'tcp[13] & 2 != 0' -w tcpdump.txt
as you of course know, it wont work.
If I pipe into a file using bash, tcpdstat is obviously not fine with the file format. Help me a bit please.
 
Old 01-22-2013, 07:38 AM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,331
Blog Entries: 55

Rep: Reputation: 3530Reputation: 3530Reputation: 3530Reputation: 3530Reputation: 3530Reputation: 3530Reputation: 3530Reputation: 3530Reputation: 3530Reputation: 3530Reputation: 3530
Quote:
Originally Posted by eeluve View Post
What I do want is something like:
Code:
tcpdump -i igb0 'tcp[13] & 2 != 0' -w tcpdump.txt
as you of course know, it wont work.
Apart from explicitly setting snaplen to zero and tacking on the BPF last as seems customary, why shouldn't it work? If you run it verbosely, without resolving any addresses and ports and without writing to a file what does it say?
 
Old 01-22-2013, 07:53 AM   #3
eeluve
Member
 
Registered: Nov 2011
Location: Russia, SPb
Distribution: all of 'em
Posts: 49

Original Poster
Rep: Reputation: Disabled
Without writing to a file everything is ok. But the exact problem is - I want to write it to a file in the order tcpdstat expects it(the order -w option meant to create, maybe im wrong). I believe its not hard, I just don't know how. And maybe another question by the way, I know about snort and stuff, but if I would make a little script for an easy hand-check, how could I make a process(utility with given arguments) to run for several seconds, count until some of the values reached the sought-for point and finish its job? I have tried with "read", "at", "sleep", combinig sed+awk, but unsuccessfully.

Last edited by eeluve; 01-22-2013 at 07:55 AM.
 
Old 01-22-2013, 08:24 AM   #4
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,331
Blog Entries: 55

Rep: Reputation: 3530Reputation: 3530Reputation: 3530Reputation: 3530Reputation: 3530Reputation: 3530Reputation: 3530Reputation: 3530Reputation: 3530Reputation: 3530Reputation: 3530
Quote:
Originally Posted by eeluve View Post
I want to write it to a file in the order tcpdstat expects it
I don't get what you're saying. There is nothing that suggests either tcpdump writes packets to file or that tcpdstat reads packets from file in any order other than FIFO.
 
Old 01-22-2013, 10:37 AM   #5
eeluve
Member
 
Registered: Nov 2011
Location: Russia, SPb
Distribution: all of 'em
Posts: 49

Original Poster
Rep: Reputation: Disabled
I could've given you a link, but its russian. And I'm home now, and no google cloud sorry, I'll try to translate and clarificate better tomorrow. But it is exactly what im talking about. I even got an idea, what exactly I have explained wrong
Quote:
tcpdump.txt
must've been .pcap.
"tcpdstat - Get protocol statistics from tcpdump pcap files". And please, if someone could throw some notes on the second part of the question?
 
Old 01-22-2013, 11:15 AM   #6
NevemTeve
Senior Member
 
Registered: Oct 2011
Location: Budapest
Distribution: Debian/GNU/Linux, AIX
Posts: 2,956

Rep: Reputation: 845Reputation: 845Reputation: 845Reputation: 845Reputation: 845Reputation: 845Reputation: 845
It is quite okay, just try to understand that the output of option '-w' is not a human readable text-file.
 
1 members found this post helpful.
Old 01-22-2013, 12:41 PM   #7
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,331
Blog Entries: 55

Rep: Reputation: 3530Reputation: 3530Reputation: 3530Reputation: 3530Reputation: 3530Reputation: 3530Reputation: 3530Reputation: 3530Reputation: 3530Reputation: 3530Reputation: 3530
Quote:
Originally Posted by eeluve View Post
I could've given you a link
Sure, just post the link.


Quote:
Originally Posted by eeluve
make a little script for an easy hand-check, how could I make a process (utility with given arguments) to run for several seconds, count until some of the values reached the sought-for point and finish its job? I have tried with "read", "at", "sleep", combinig sed+awk, but unsuccessfully.
It kind of depends on what "sought-for point" means. If "sought-for point" means a packet counter then there's 'tcpdump -c' or 'tshark -c', elif it means input bytes there's 'cut -b' or 'dd count=' or 'od -N', elif it's a simple counter your could ((N++)) in BASH. Else if it means some combination, like \( total pkt count and 3 SYN ACKs and within 10 seconds \) then you best explain what you're trying to accomplish: (pseudo) script welcome.
 
1 members found this post helpful.
Old 01-23-2013, 12:50 AM   #8
eeluve
Member
 
Registered: Nov 2011
Location: Russia, SPb
Distribution: all of 'em
Posts: 49

Original Poster
Rep: Reputation: Disabled
Thank you, even tho I'm not the best explainer out there, the info you gave me is exactly what I've been seeking for. And if you still want the link, here goes http://www.bit-team.com/index.php?showtopic=3930 Short story is, he explains how to use all these utilities for good taking cisco as example. But he is talking superficially, so I kind of interpret it for myself.
 
Old 01-23-2013, 02:38 PM   #9
linosaurusroot
Member
 
Registered: Oct 2012
Distribution: OpenSuSE,RHEL,Fedora,OpenBSD
Posts: 979
Blog Entries: 2

Rep: Reputation: 235Reputation: 235Reputation: 235
Quote:
Originally Posted by NevemTeve View Post
It is quite okay, just try to understand that the output of option '-w' is not a human readable text-file.
What's been created with tcpdump -w gets read with tcpdump -r.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Parsing tcpdump output file Edward18 Linux - Networking 2 01-02-2012 05:58 AM
TcpDump / Grep / Pipe to file Reefcrazed Linux - Networking 7 06-23-2010 08:46 PM
Tcpdump - Capture file whenever file reached the specified limit apit Linux - Networking 5 09-13-2008 04:00 AM
tcpdump file vkmgeek Linux - Networking 1 08-18-2006 02:53 AM


All times are GMT -5. The time now is 02:58 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration