Geek Answers Handbook

Turn on packets received by TCPDUMP

How can I use the "tcpdump" command to capture and save all received packets for file splitting (with rotation on a packet without losing any packets).

+5
source share
1 answer

How about saving a dump to a file and splitting it into separate files?

$ sudo tcpdump -c 10 -w mycap.pcap tcpdump: data link type PKTAP tcpdump: listening on pktap, link-type PKTAP (Packet Tap), capture size 65535 bytes 10 packets captured

you will need to install wirehark for this (for example, using brew install the proxy server on Mac or apt-get on Ubuntu)

 $ editcap -c 1 mycap.pcap output.pcap

10 captured packets โ†’ 10 created files

 $ ls -la output* | wc -l 10
+3
source

More articles:


All Articles