tcpdump time filter

Let's say I have a tcpdump file. Is there a way to only print packets that has arrived after a certain time? Capture file contains traffic from 1pm to 7pm. I want to print all packets after 5pm. Like...

tcpdump -nr source.cap time >= 17:00

I'm trying to use this in a script. Thanks.
zycaAsked:
Who is Participating?
 
RickAtreidesConnect With a Mentor Commented:
tcpdump has no ability to filter packets by timestamp, so you should filter output with some script like

sudo tcpdump -i eth0  | ./filter-time.pl '17:00:00' 22:00:00'

Please note, that tcpdump's output didn't contain day part, so you should care about time ranges over midnight like 23:00 -> 01:00.
#!/usr/bin/perl
 
# Convert time range to seconds from midnight
$ARGV[0] =~ /(\d{2}):(\d{2}):(\d{2})/;
$begin_t = $3 + 60 * $2 + 60 * 60 * $1;
$ARGV[1] =~ /(\d{2}):(\d{2}):(\d{2})/;
$end_t = $3 + 60 * $2 + 60 * 60 * $1;
 
while (<STDIN>) {
 # If row begin with time stamp 
 if (/^(\d{2}):(\d{2}):(\d{2}).\d{6}/) {
   $time = $3 + 60 * $2 + 60 * 60 * $1;
   # We make decision is it packet in range or not
   if ($time <= $end_t && $time >= $begin_t) {
    $print_packet=1
   } else {
    $print_packet=0
   }
 }
 
 if ($print_packet) { print $_ }
}

Open in new window

0
 
gheistCommented:
Start your script in particular time. tcpdump is not scheduler.
0
 
gheistConnect With a Mentor Commented:
wireshark includes command line capture file converter that does what you beg for.
0
 
group0Connect With a Mentor Commented:
Run it through Wireshark and use a filter in the format:

frame.time >= "Aug 4, 2010 17:00:00"
0
All Courses

From novice to tech pro — start learning today.