Solved

tcpdump time filter

Posted on 2009-04-08
6
1,594 Views
Last Modified: 2014-06-17
Let's say I have a tcpdump file. Is there a way to only print packets that has arrived after a certain time? Capture file contains traffic from 1pm to 7pm. I want to print all packets after 5pm. Like...

tcpdump -nr source.cap time >= 17:00

I'm trying to use this in a script. Thanks.
0
Comment
Question by:zyca
  • 2
6 Comments
 
LVL 62

Expert Comment

by:gheist
ID: 24124825
Start your script in particular time. tcpdump is not scheduler.
0
 

Accepted Solution

by:
RickAtreides earned 168 total points
ID: 25040601
tcpdump has no ability to filter packets by timestamp, so you should filter output with some script like

sudo tcpdump -i eth0  | ./filter-time.pl '17:00:00' 22:00:00'

Please note, that tcpdump's output didn't contain day part, so you should care about time ranges over midnight like 23:00 -> 01:00.
#!/usr/bin/perl
 
# Convert time range to seconds from midnight
$ARGV[0] =~ /(\d{2}):(\d{2}):(\d{2})/;
$begin_t = $3 + 60 * $2 + 60 * 60 * $1;
$ARGV[1] =~ /(\d{2}):(\d{2}):(\d{2})/;
$end_t = $3 + 60 * $2 + 60 * 60 * $1;
 
while (<STDIN>) {
 # If row begin with time stamp 
 if (/^(\d{2}):(\d{2}):(\d{2}).\d{6}/) {
   $time = $3 + 60 * $2 + 60 * 60 * $1;
   # We make decision is it packet in range or not
   if ($time <= $end_t && $time >= $begin_t) {
    $print_packet=1
   } else {
    $print_packet=0
   }
 }
 
 if ($print_packet) { print $_ }
}

Open in new window

0
 
LVL 62

Assisted Solution

by:gheist
gheist earned 166 total points
ID: 25040938
wireshark includes command line capture file converter that does what you beg for.
0
 
LVL 5

Assisted Solution

by:group0
group0 earned 166 total points
ID: 33431731
Run it through Wireshark and use a filter in the format:

frame.time >= "Aug 4, 2010 17:00:00"
0

Featured Post

Easy, flexible multimedia distribution & control

Coming soon!  Ideal for large-scale A/V applications, ATEN's VM3200 Modular Matrix Switch is an all-in-one solution that simplifies video wall integration. Easily customize display layouts to see what you want, how you want it in 4k.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Even if you have implemented a Mobile Device Management solution company wide, it is a good idea to make sure you are taking into account all of the major risks to your electronic protected health information (ePHI).
I had an issue with InstallShield not being able to use Computer Browser service on Windows Server 2012. Here is the solution I found.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Internet Business Fax to Email Made Easy - With  eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, f…

861 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question