I have a Adapter installed and working on RHEL server which faces disconnection when a particular signal message is sent from the Source to which this adapter is connected.
In order to capture the raw packets from the Source IP address I am using the
tcpdump utility. However, the problem with using
tcpdump is that it continuously captures all the packets from the source including the traffic in which I am not interested.
This leads to huge disk space utilization because there is a huge incoming of data from the source IP address on this particular port which is used for communication between my adapter and the source server.
Is there a way or default Linux utility which can be used to capture only those packets which have a specific string eg. eventLossOccurred so that at the end, I just have those packets captured which contains those messages?
I have searched the various options for
tcpdump however, I didn't find a way to get the desired results using this utility.