Solved

tcpdump time filter

Posted on 2009-04-08
6
1,444 Views
Last Modified: 2014-06-17
Let's say I have a tcpdump file. Is there a way to only print packets that has arrived after a certain time? Capture file contains traffic from 1pm to 7pm. I want to print all packets after 5pm. Like...

tcpdump -nr source.cap time >= 17:00

I'm trying to use this in a script. Thanks.
0
Comment
Question by:zyca
  • 2
6 Comments
 
LVL 61

Expert Comment

by:gheist
Comment Utility
Start your script in particular time. tcpdump is not scheduler.
0
 

Accepted Solution

by:
RickAtreides earned 168 total points
Comment Utility
tcpdump has no ability to filter packets by timestamp, so you should filter output with some script like

sudo tcpdump -i eth0  | ./filter-time.pl '17:00:00' 22:00:00'

Please note, that tcpdump's output didn't contain day part, so you should care about time ranges over midnight like 23:00 -> 01:00.
#!/usr/bin/perl
 

# Convert time range to seconds from midnight

$ARGV[0] =~ /(\d{2}):(\d{2}):(\d{2})/;

$begin_t = $3 + 60 * $2 + 60 * 60 * $1;

$ARGV[1] =~ /(\d{2}):(\d{2}):(\d{2})/;

$end_t = $3 + 60 * $2 + 60 * 60 * $1;
 

while (<STDIN>) {

 # If row begin with time stamp 

 if (/^(\d{2}):(\d{2}):(\d{2}).\d{6}/) {

   $time = $3 + 60 * $2 + 60 * 60 * $1;

   # We make decision is it packet in range or not

   if ($time <= $end_t && $time >= $begin_t) {

    $print_packet=1

   } else {

    $print_packet=0

   }

 }
 

 if ($print_packet) { print $_ }

}

Open in new window

0
 
LVL 61

Assisted Solution

by:gheist
gheist earned 166 total points
Comment Utility
wireshark includes command line capture file converter that does what you beg for.
0
 
LVL 5

Assisted Solution

by:group0
group0 earned 166 total points
Comment Utility
Run it through Wireshark and use a filter in the format:

frame.time >= "Aug 4, 2010 17:00:00"
0

Featured Post

Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

Join & Write a Comment

Some time ago I was asked to set up a web portal PC to put at our entrance. When customers arrive, they could see a webpage 'promoting' our company. So I tried to set up a windows 7 PC as a kiosk PC.......... I will spare you all the annoyances I…
Network ports are the threads that hold network communication together. They are an essential part of networking that can be easily ignore or misunderstood, my goals is to show those who don't have a strong network foundation how network ports opera…
Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now