tcpdump - issue faced with dumping UDP packets
 

I'm a linux newbie... & facing a problem in using "tcpdump"

I have a scenario where an encoder keeps throwing UDP packets on a specified port... each with some bytes of data (let's say 1000 bytes - that means "header + 1000 bytes")

on the other end, I have a program running which will call "tcpdump" from a .c file to receive the packets from the specified port with the given encoder IP.

Case 1: Woking FINE
===============

I call tcpdump from .c file by giving -w$(fileName) option and it dumps the packets to the file as required. When I see the generated pcap file in "etherreal" I can see all the packets. Each packet has some overhead followed by data... (let's say 44 bytes of header + 1000 bytes of data)

so if encoder throws 1000 packets, then all 1000 packets are dumped in single file... Data captured is right as well...

Case 2: NOT Woking
===============

I want a scenario where data is dumped in files in the chunk of 1 MB. I mean only data (1000 bytes only and not 44 bytes of header) should be dumped. so 1st 1MB data chunk in file "dump1.yuv", 2nd 1MB data chunk in file "dump2.yuv" and like wise.

I've used -c and -C options but they didn't work as per my expectation... how do I make this happen? If u have any hint/ code drop then please pass it on... It'll be a gr8 help :)

Thanks in advance... :)

this really isn't what tcpdump is for. I'd suggest you just listen yourself rather than through tcpdump then do whatever you want with the data. if you do wish to sniff rather than open a socket conventionally then there are libpcap tutorials to get you through it. http://www.cet.nau.edu/~mc8/Socket/T.../section1.html

you're right, tcpdump is not for that... I haven't done much of network related programming, so I didn't know it...

They have developed a highly capable/potential library (libpcap) for me to achieve a small task that I'm trying to undertake and I didn't know it :)

The link you sent, helped a lot, thanks a lot :)