Sort pcap file contents by file date

zakiakhmad · 12-27-2011, 03:56 AM

Quote:

Originally Posted by apit

Thanks a lot Nylex & Mr.C
I do both of the option and it running ok

Option 1

Option 2

This command works fine! But I need the timestamp when the files were created. I need to sort my pcap file based on the date.

# ls -l

-rw-r--r-- 1 root root 1001494 2011-12-27 16:19 capture-20111227-161801.pcap
-rw-r--r-- 1 root root 1000435 2011-12-27 16:21 capture-20111227-161801.pcap1
-rw-r--r-- 1 root root 1001151 2011-12-27 16:33 capture-20111227-161801.pcap10
-rw-r--r-- 1 root root 1001450 2011-12-27 16:34 capture-20111227-161801.pcap11
-rw-r--r-- 1 root root 345042 2011-12-27 16:34 capture-20111227-161801.pcap12
-rw-r--r-- 1 root root 1000054 2011-12-27 16:23 capture-20111227-161801.pcap2
-rw-r--r-- 1 root root 1000711 2011-12-27 16:24 capture-20111227-161801.pcap3
-rw-r--r-- 1 root root 1000701 2011-12-27 16:26 capture-20111227-161801.pcap4
-rw-r--r-- 1 root root 1001092 2011-12-27 16:27 capture-20111227-161801.pcap5
-rw-r--r-- 1 root root 1001141 2011-12-27 16:29 capture-20111227-161801.pcap6
-rw-r--r-- 1 root root 1000057 2011-12-27 16:30 capture-20111227-161801.pcap7
-rw-r--r-- 1 root root 1001202 2011-12-27 16:31 capture-20111227-161801.pcap8
-rw-r--r-- 1 root root 1001424 2011-12-27 16:32 capture-20111227-161801.pcap9

jschiwal · 12-27-2011, 10:25 AM

I moved your post to its own thread because it is another topic. Please provide more explanation on what you want to do.
You are providing a file list, but say you want to sort the pcap file contents by a date field.

zakiakhmad · 12-28-2011, 04:40 AM

I want to have pcap file with each size 1 MB and it has their own timestamp. I don't want the filename is like:
- something.pcap
- something.pcap1
- something.pcap2
....

because it would be difficult to sort by date.

I want the filename has its own timestamp when the file is created. So my requirement is like:
- something-20111228-17.38.01.pcap
- something-20111228-17.45.50.pcap

and so on. Hope it explains.

Reuti · 12-28-2011, 05:00 AM

Whether the creation time is stored at all in the directory entry depends on the filesystem used. In ext4 (IIRC also ZFS) it’s foreseen to have a crtime and it shows up in stat as “Birth: ...” line. But for me it’s never displaying any useful data but appears always empty. It also looks, like ls has no option for now to sort by crtime.

zakiakhmad · 01-03-2012, 06:11 AM

Quote:

Originally Posted by Reuti

Whether the creation time is stored at all in the directory entry depends on the filesystem used. In ext4 (IIRC also ZFS) it’s foreseen to have a crtime and it shows up in stat as “Birth: ...” line. But for me it’s never displaying any useful data but appears always empty. It also looks, like ls has no option for now to sort by crtime.

Does it mean, tcpdump create all the pcap file at the time when the command executed and the -C option only cut and then re-create the file?

Reuti · 01-03-2012, 06:40 AM

This I don’t know for sure, as I never dealt with tcpdump. It looks like the name is created when the command started. Later on it only increases the appended number. In some way it makes sense, as you know this way which files are from one run, in case you have several ones from different runs in one and the same directory. I was looking therefore for a date of birth on the OS level, as the ctime won’t help, we need the crtime.