LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Software (http://www.linuxquestions.org/questions/linux-software-2/)
-   -   Packet size logging program (http://www.linuxquestions.org/questions/linux-software-2/packet-size-logging-program-857928/)

thelordmule 01-22-2011 02:14 AM

Packet size logging program
 
Hello all,

I am looking for a simple packet logging utility that just samples the size of incoming/outgoing packets at a fixed interval.

I am not sure how to manipulate the db files generated by darkstat, vnstat, ntop.

I found live vnstat -i eth0 -l give me almost what I need, but I can't save the output because they rewrite the same terminal space :(

darkstat makes a nice graph via web interface, but I want the data for the graph :(

just looked into snort and found that I can go through every packet, and grep the file for the content-length, however the time of arrival for each packet is a bit fidgity.

at the very least I am just looking for a program that gives me one column bytes sent for a fixed time interval:
Code:

size
30049
29992
84384

OR two columns, with time of sending and size for each packet
Code:

seconds    size
12345069 30049
12345069 29992
12345070 84384

Any suggestions?

sys64738 01-22-2011 07:28 PM

Hmm not quite sure but how about iptraf?
It is not only doing stuff with curses but also wit the command line.
Try:
Code:

man iptraf
I think the option "-L" and the signal "SIGUSR1" might be helpful to you.

thelordmule 01-26-2011 08:25 PM

Quote:

Originally Posted by sys64738 (Post 4234463)
Hmm not quite sure but how about iptraf?

Thanks for the tip. this is a very nice program. I liked the log file how it presented all the packet sizes, but only logged the first packet size of TCP, whereas all UDP packets are logged :(

I am rummaging through the source for a quick fix, but its a little tricky...

thelordmule 01-26-2011 08:38 PM

I found it! and too conveniently

iptrafmon.c find the code:
Code:

(tcpentry->pcount == 1) &&
and comment it out

recompile

run
Code:

sudo ./iptraf -i eth0 -L apptcptest.log
A glorious amount of TCP traffic data with packet sizes will be at your disposal!

Thanks again sys64738!


All times are GMT -5. The time now is 11:46 PM.