2

I'm using Gulp to capture packets at 100Mbps to a folder. But I would like to name the files in format job_<'%Y_%m_%d_%H_%M_%S'>.pcap, but it gives files job.pcap0, job.pcap2 etc. The script I use is :

 sudo ./gulp -f "dst net 24.10.10 or dst net 224.11.11" -i eth1 -r 1024| taskset -c 2 tcpdump -r- -C 2 -w /share/job/job.pcap

How do I do get time stamp on the file name?

Improve this question

2 Answers 2

Reset to default
2

Use 

/share/job/job_`date +%y_%m_%d_%H_%M_%S`.pcap

as logfile name.

Improve this answer
4
  • Hi, the filenames are coming in the format but it seems to have an ending number like job_15_08_05_13_29_58.pcap3, job_15_08_05_13_29_58.pcap4 etc
    – Jishnu U Nair
    Aug 5, 2015 at 10:38
  • 1
    That is because the output is bigger than 2000000 bytes. You have specified -C 2 to define this. Perhaps you should remove this parameter or make the value higher if you do not want this to happen. Check linux.die.net/man/8/tcpdump for more information.
    – Marco
    Aug 5, 2015 at 11:35
  • Hi, thank you for the reply, I understand your comment, but that is what I'm trying to do, to create new pcap file every time the limit is reached (2MB), and I was hoping as the file name changed as it is dependent on the date time the tailing number would not come up.
    – Jishnu U Nair
    Aug 5, 2015 at 11:44
  • tcpdump gets a 'fixed' filename. It is not aware of the way how it was passed.
    – Marco
    Aug 5, 2015 at 11:59
1

-t - allows to add a timestamp to the filename

Reference: gulpman

You can then take that filename, extract the integer part & format it to any date format as per your requirement.

Improve this answer
1
  • But i'm using tcpdump to write the file not Gulp, so this does not work
    – Jishnu U Nair
    Aug 5, 2015 at 9:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.