Solved

tcpdump time filter

Posted on 2009-04-08
6
1,816 Views
Last Modified: 2014-06-17
Let's say I have a tcpdump file. Is there a way to only print packets that has arrived after a certain time? Capture file contains traffic from 1pm to 7pm. I want to print all packets after 5pm. Like...

tcpdump -nr source.cap time >= 17:00

I'm trying to use this in a script. Thanks.
0
Comment
Question by:zyca
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
6 Comments
 
LVL 62

Expert Comment

by:gheist
ID: 24124825
Start your script in particular time. tcpdump is not scheduler.
0
 

Accepted Solution

by:
RickAtreides earned 168 total points
ID: 25040601
tcpdump has no ability to filter packets by timestamp, so you should filter output with some script like

sudo tcpdump -i eth0  | ./filter-time.pl '17:00:00' 22:00:00'

Please note, that tcpdump's output didn't contain day part, so you should care about time ranges over midnight like 23:00 -> 01:00.
#!/usr/bin/perl
 
# Convert time range to seconds from midnight
$ARGV[0] =~ /(\d{2}):(\d{2}):(\d{2})/;
$begin_t = $3 + 60 * $2 + 60 * 60 * $1;
$ARGV[1] =~ /(\d{2}):(\d{2}):(\d{2})/;
$end_t = $3 + 60 * $2 + 60 * 60 * $1;
 
while (<STDIN>) {
 # If row begin with time stamp 
 if (/^(\d{2}):(\d{2}):(\d{2}).\d{6}/) {
   $time = $3 + 60 * $2 + 60 * 60 * $1;
   # We make decision is it packet in range or not
   if ($time <= $end_t && $time >= $begin_t) {
    $print_packet=1
   } else {
    $print_packet=0
   }
 }
 
 if ($print_packet) { print $_ }
}

Open in new window

0
 
LVL 62

Assisted Solution

by:gheist
gheist earned 166 total points
ID: 25040938
wireshark includes command line capture file converter that does what you beg for.
0
 
LVL 5

Assisted Solution

by:group0
group0 earned 166 total points
ID: 33431731
Run it through Wireshark and use a filter in the format:

frame.time >= "Aug 4, 2010 17:00:00"
0

Featured Post

Visualize your virtual and backup environments

Create well-organized and polished visualizations of your virtual and backup environments when planning VMware vSphere, Microsoft Hyper-V or Veeam deployments. It helps you to gain better visibility and valuable business insights.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

For many of us, the  holiday season kindles the natural urge to give back to our friends, family members and communities. While it's easy for friends to notice the impact of such deeds, understanding the contributions of businesses and enterprises i…
This program is used to assist in finding and resolving common problems with wireless connections.
Michael from AdRem Software outlines event notifications and Automatic Corrective Actions in network monitoring. Automatic Corrective Actions are scripts, which can automatically run upon discovery of a certain undesirable condition in your network.…
In this brief tutorial Pawel from AdRem Software explains how you can quickly find out which services are running on your network, or what are the IP addresses of servers responsible for each service. Software used is freeware NetCrunch Tools (https…
Suggested Courses

621 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question