LinuxQuestions.org
Latest LQ Deal: Latest LQ Deals
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 12-27-2011, 03:56 AM   #1
zakiakhmad
LQ Newbie
 
Registered: Dec 2011
Posts: 3

Rep: Reputation: Disabled
Sort pcap file contents by file date


Quote:
Originally Posted by apit View Post
Thanks a lot Nylex & Mr.C
I do both of the option and it running ok

Option 1


Option 2
This command works fine! But I need the timestamp when the files were created. I need to sort my pcap file based on the date.

# ls -l

-rw-r--r-- 1 root root 1001494 2011-12-27 16:19 capture-20111227-161801.pcap
-rw-r--r-- 1 root root 1000435 2011-12-27 16:21 capture-20111227-161801.pcap1
-rw-r--r-- 1 root root 1001151 2011-12-27 16:33 capture-20111227-161801.pcap10
-rw-r--r-- 1 root root 1001450 2011-12-27 16:34 capture-20111227-161801.pcap11
-rw-r--r-- 1 root root 345042 2011-12-27 16:34 capture-20111227-161801.pcap12
-rw-r--r-- 1 root root 1000054 2011-12-27 16:23 capture-20111227-161801.pcap2
-rw-r--r-- 1 root root 1000711 2011-12-27 16:24 capture-20111227-161801.pcap3
-rw-r--r-- 1 root root 1000701 2011-12-27 16:26 capture-20111227-161801.pcap4
-rw-r--r-- 1 root root 1001092 2011-12-27 16:27 capture-20111227-161801.pcap5
-rw-r--r-- 1 root root 1001141 2011-12-27 16:29 capture-20111227-161801.pcap6
-rw-r--r-- 1 root root 1000057 2011-12-27 16:30 capture-20111227-161801.pcap7
-rw-r--r-- 1 root root 1001202 2011-12-27 16:31 capture-20111227-161801.pcap8
-rw-r--r-- 1 root root 1001424 2011-12-27 16:32 capture-20111227-161801.pcap9
 
Old 12-27-2011, 10:25 AM   #2
jschiwal
LQ Guru
 
Registered: Aug 2001
Location: Fargo, ND
Distribution: SuSE AMD64
Posts: 15,733

Rep: Reputation: 682Reputation: 682Reputation: 682Reputation: 682Reputation: 682Reputation: 682
I moved your post to its own thread because it is another topic. Please provide more explanation on what you want to do.
You are providing a file list, but say you want to sort the pcap file contents by a date field.
 
Old 12-28-2011, 04:40 AM   #3
zakiakhmad
LQ Newbie
 
Registered: Dec 2011
Posts: 3

Original Poster
Rep: Reputation: Disabled
I want to have pcap file with each size 1 MB and it has their own timestamp. I don't want the filename is like:
- something.pcap
- something.pcap1
- something.pcap2
....

because it would be difficult to sort by date.

I want the filename has its own timestamp when the file is created. So my requirement is like:
- something-20111228-17.38.01.pcap
- something-20111228-17.45.50.pcap

and so on. Hope it explains.
 
Old 12-28-2011, 05:00 AM   #4
Reuti
Senior Member
 
Registered: Dec 2004
Location: Marburg, Germany
Distribution: openSUSE 15.2
Posts: 1,339

Rep: Reputation: 260Reputation: 260Reputation: 260
Whether the creation time is stored at all in the directory entry depends on the filesystem used. In ext4 (IIRC also ZFS) it’s foreseen to have a crtime and it shows up in stat as “Birth: ...” line. But for me it’s never displaying any useful data but appears always empty. It also looks, like ls has no option for now to sort by crtime.
 
Old 01-03-2012, 06:11 AM   #5
zakiakhmad
LQ Newbie
 
Registered: Dec 2011
Posts: 3

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by Reuti View Post
Whether the creation time is stored at all in the directory entry depends on the filesystem used. In ext4 (IIRC also ZFS) it’s foreseen to have a crtime and it shows up in stat as “Birth: ...” line. But for me it’s never displaying any useful data but appears always empty. It also looks, like ls has no option for now to sort by crtime.
Does it mean, tcpdump create all the pcap file at the time when the command executed and the -C option only cut and then re-create the file?
 
Old 01-03-2012, 06:40 AM   #6
Reuti
Senior Member
 
Registered: Dec 2004
Location: Marburg, Germany
Distribution: openSUSE 15.2
Posts: 1,339

Rep: Reputation: 260Reputation: 260Reputation: 260
This I don’t know for sure, as I never dealt with tcpdump. It looks like the name is created when the command started. Later on it only increases the appended number. In some way it makes sense, as you know this way which files are from one run, in case you have several ones from different runs in one and the same directory. I was looking therefore for a date of birth on the OS level, as the ctime won’t help, we need the crtime.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] Bash, when I read sort write md5 file, the writen file have a space missing peter1234 Linux - General 3 09-21-2010 09:04 AM
[SOLVED] BASH: Keep original mod date of a file and 'date' it back to same file? SilversleevesX Programming 4 07-16-2010 11:12 AM
cat FILE|sort +1 -n Returns ... +1: No such file or directory musician Linux - Newbie 1 07-23-2009 01:28 PM
sort date in paragraphs within file nabmufti Programming 3 02-14-2008 10:13 AM
bash sort files by date in file name thedude2010 Programming 6 05-12-2006 11:07 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 05:12 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration