1

I am attempting to send multiple pcaps into an xargs loop in order to tcpdump them into a single file. These are 1GB PCAP files from Bro's Timemachine.

There are examples online, but the only one I can get to work is to mergecap them before processing them, which is very processor intensive.

I tried...

ls class_all_1447887* | xargs -t -I file tcpdump -nnr file -w ~/test.cap "src 127.1.0.1"

...but it would recreate test.cap for each loop instead of adding as it went.

Is there a way to do this without making a 15GB file first from which to carve out sessions?

1

Instead of having tcpdump create a new file each time, let tcpdump write to standard output and redirect the output of the entire command to ~/test.cap.

Like this:

ls class_all_1447887* |
xargs -t -I file tcpdump -nnr file "src 127.1.0.1" > ~/test.cap

Or you can write a different file for each input file:

mkdir ~/test.cap.d
ls class_all_1447887* |
xargs -t -I file tcpdump -nnr file -w ~/test.cap.d/file.tcpd "src 127.1.0.1"

I am not familiar with NetMiner's and Wireshark's input requirements, nor about the output of tcpdump.

  • Netminer and Wireshark both claim the resulting file "appears to be damaged or corrupt". Any ideas? – user112802 Nov 24 '15 at 6:36
  • Do you know if it's possible to store multiples in one file? Where would the format be defined? – RobertL Nov 24 '15 at 6:59
  • I found this (draconyx.net/articles/…) which talks about keeping the header intact, but I'm having trouble translating the directions to this task. – user112802 Nov 24 '15 at 7:07
  • Ok. I think I get it but I have to sleep. I will check back in 8 to 12 hours. – RobertL Nov 24 '15 at 7:36
1

I am attempting to send multiple pcaps into an xargs loop in order to tcpdump them into a single file.

Tcpdump doesn't support merging pcap files.

mergecap does, but if you don't want to use it because it takes too much CPU, and if

  1. the files all have the same link-layer header type (e.g., Ethernet) and the same snapshot length;
  2. you just want to concatenate the files, because the N+1'st file has packets all of which come after the packets in the Nth file, for all values of N;

you'll need to try something similar to the solution in the "Header Manipulation Examples" section of the article you found. That example means you must treat the first file being concatenated differently from all the other files, as you'll be stripping the file header off of all the other files but not the first file.

Here's a script that should do that:

#! /bin/sh
first_file=yes
for i in class_all_1447887*
do
    if [ "$first_file" = "no" ]
    then
        #
        # Strip off file header from tcpdump's output.
        #
        tcpdump -r "$i" -w - "src 127.1.0.1" | \
            (dd of=/dev/null bs=24 count=1; cat)
    else
        tcpdump -r "$i" -w - "src 127.1.0.1"
        first_file=no
    fi
done > test.cap
  • I understand what you've written well enough to believe it would work, but thus far all of my work with regex/bash has been one-line commands. I am unclear how to take what you've written and incorporate it into an efficient method of carving pcap. This is something I need to do many times a day. After @RobertL's help last night, I have been using: ls class_all_14484[0-1]* | xargs -t -I file tcpdump -nnr file -w ~/pcaps/file.pcap "host 127.1.0.1" followed by mergecap *.pcap -w ~/results.cap How could I use your program to make this process more efficient? – user112802 Nov 25 '15 at 8:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.