Latest LQ Deal: Linux Power User Bundle
Go Back > Forums > Linux Forums > Linux - Newbie
User Name
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!


  Search this Thread
Old 02-09-2008, 09:48 AM   #1
LQ Newbie
Registered: Jan 2008
Posts: 8

Rep: Reputation: 0
tcpdump - issue faced with dumping UDP packets

I'm a linux newbie... & facing a problem in using "tcpdump"

I have a scenario where an encoder keeps throwing UDP packets on a specified port... each with some bytes of data (let's say 1000 bytes - that means "header + 1000 bytes")

on the other end, I have a program running which will call "tcpdump" from a .c file to receive the packets from the specified port with the given encoder IP.

Case 1: Woking FINE

I call tcpdump from .c file by giving -w$(fileName) option and it dumps the packets to the file as required. When I see the generated pcap file in "etherreal" I can see all the packets. Each packet has some overhead followed by data... (let's say 44 bytes of header + 1000 bytes of data)

so if encoder throws 1000 packets, then all 1000 packets are dumped in single file... Data captured is right as well...

Case 2: NOT Woking

I want a scenario where data is dumped in files in the chunk of 1 MB. I mean only data (1000 bytes only and not 44 bytes of header) should be dumped. so 1st 1MB data chunk in file "dump1.yuv", 2nd 1MB data chunk in file "dump2.yuv" and like wise.

I've used -c and -C options but they didn't work as per my expectation... how do I make this happen? If u have any hint/ code drop then please pass it on... It'll be a gr8 help

Thanks in advance...
Old 02-09-2008, 10:49 AM   #2
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1975Reputation: 1975Reputation: 1975Reputation: 1975Reputation: 1975Reputation: 1975Reputation: 1975Reputation: 1975Reputation: 1975Reputation: 1975Reputation: 1975
this really isn't what tcpdump is for. I'd suggest you just listen yourself rather than through tcpdump then do whatever you want with the data. if you do wish to sniff rather than open a socket conventionally then there are libpcap tutorials to get you through it.
Old 02-09-2008, 11:38 PM   #3
LQ Newbie
Registered: Jan 2008
Posts: 8

Original Poster
Rep: Reputation: 0
you're right, tcpdump is not for that... I haven't done much of network related programming, so I didn't know it...

They have developed a highly capable/potential library (libpcap) for me to achieve a small task that I'm trying to undertake and I didn't know it

The link you sent, helped a lot, thanks a lot


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
UDP viewer, like tcpdump? ivanatora Linux - Networking 2 04-24-2007 04:45 PM
UDP: Short Packets: and UDP bad checksum: entries in dmesg minutes2memories Linux - Networking 2 02-26-2006 08:28 PM
tcpdump and UDP Denes Linux - Networking 0 06-22-2004 01:15 PM
encapsulating TCP packets in UDP packets... yoshi95 Programming 3 06-03-2004 03:53 PM
How to receive UDP and ICMP packets, by one UDP socket(PMTUD) myself_rajat Linux - Networking 0 05-28-2004 06:43 AM > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 09:01 PM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration