parsed.org

Tips by tag: bc

Tcpslice by xinu on Jan 23, 2007 09:54 AM

If you have a really large capture file and you need to grab the first 5 minutes, you can do something like the following:

[root@system]# tcpslice -R ./capture.cap
./capture.cap   1168365532.235679       1168370500.728519

[root@system]# expr 1168365532 "+" 300
1168365832

[root@system]# tcpslice -w 5m.cap 1168365532.235679 1168365832.235679 ./capture.cap

That leaves you with a smaller capture consisting of 300 seconds (5 minutes) worth of traffic.

Note: Newer versions of tcpslice than the one I used (v1.1a3) support relative notation like +30m.

bcethernettcpdumptcpslice
RSS