Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

tcpdump time filter

Posted on 2009-04-08
6
Medium Priority
?
2,060 Views
Last Modified: 2014-06-17
Let's say I have a tcpdump file. Is there a way to only print packets that has arrived after a certain time? Capture file contains traffic from 1pm to 7pm. I want to print all packets after 5pm. Like...

tcpdump -nr source.cap time >= 17:00

I'm trying to use this in a script. Thanks.
0
Comment
Question by:zyca
  • 2
6 Comments
 
LVL 62

Expert Comment

by:gheist
ID: 24124825
Start your script in particular time. tcpdump is not scheduler.
0
 

Accepted Solution

by:
RickAtreides earned 672 total points
ID: 25040601
tcpdump has no ability to filter packets by timestamp, so you should filter output with some script like

sudo tcpdump -i eth0  | ./filter-time.pl '17:00:00' 22:00:00'

Please note, that tcpdump's output didn't contain day part, so you should care about time ranges over midnight like 23:00 -> 01:00.
#!/usr/bin/perl
 
# Convert time range to seconds from midnight
$ARGV[0] =~ /(\d{2}):(\d{2}):(\d{2})/;
$begin_t = $3 + 60 * $2 + 60 * 60 * $1;
$ARGV[1] =~ /(\d{2}):(\d{2}):(\d{2})/;
$end_t = $3 + 60 * $2 + 60 * 60 * $1;
 
while (<STDIN>) {
 # If row begin with time stamp 
 if (/^(\d{2}):(\d{2}):(\d{2}).\d{6}/) {
   $time = $3 + 60 * $2 + 60 * 60 * $1;
   # We make decision is it packet in range or not
   if ($time <= $end_t && $time >= $begin_t) {
    $print_packet=1
   } else {
    $print_packet=0
   }
 }
 
 if ($print_packet) { print $_ }
}

Open in new window

0
 
LVL 62

Assisted Solution

by:gheist
gheist earned 664 total points
ID: 25040938
wireshark includes command line capture file converter that does what you beg for.
0
 
LVL 5

Assisted Solution

by:group0
group0 earned 664 total points
ID: 33431731
Run it through Wireshark and use a filter in the format:

frame.time >= "Aug 4, 2010 17:00:00"
0

Featured Post

Fill in the form and get your FREE NFR key NOW!

Veeam is happy to provide a FREE NFR server license to certified engineers, trainers, and bloggers.  It allows for the non‑production use of Veeam Agent for Microsoft Windows. This license is valid for five workstations and two servers.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article is in regards to the Cisco QSFP-4SFP10G-CU1M cables, which are designed to uplink/downlink 40GB ports to 10GB SFP ports. I recently experienced this and found very little configuration documentation on how these are supposed to be confi…
This article will show how Aten was able to supply easy management and control for Artear's video walls and wide range display configurations of their newsroom.
If you're a developer or IT admin, you’re probably tasked with managing multiple websites, servers, applications, and levels of security on a daily basis. While this can be extremely time consuming, it can also be frustrating when systems aren't wor…
In this video we outline the Physical Segments view of NetCrunch network monitor. By following this brief how-to video, you will be able to learn how NetCrunch visualizes your network, how granular is the information collected, as well as where to f…
Suggested Courses

916 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question