2

I have a Adapter installed and working on RHEL server which faces disconnection when a particular signal message is sent from the Source to which this adapter is connected.

In order to capture the raw packets from the Source IP address I am using the tcpdump utility. However, the problem with using tcpdump is that it continuously captures all the packets from the source including the traffic in which I am not interested.

This leads to huge disk space utilization because there is a huge incoming of data from the source IP address on this particular port which is used for communication between my adapter and the source server.

Is there a way or default Linux utility which can be used to capture only those packets which have a specific string eg. eventLossOccurred so that at the end, I just have those packets captured which contains those messages?

I have searched the various options for tcpdump however, I didn't find a way to get the desired results using this utility.

1 Answer 1

2

You can use 'tshark' (part of wireshark) and use display filter "contains/matches" to look for a string. Assuming it's a tcp packet, your filter could be something like this

tshark -Y 'tcp contains "eventLossOccurred"'

using 'matches', you could specify perl regular expressions

NOTE: This will only display the packet details, you cannot use this to capture full packet dump in PCAP format. Modify tshark options to display required details

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .