1

I am processing the output of tcpdump on Ubuntu 16.04LTS using the following command:

$ sudo tcpdump -i wlan0 -e -s 64 -n -j adapter -K -l | python script.py

This works, but unfortunately, there are too many packets to handle for the scripts I want to write, so I would like to remove packets that are coming from the same IP address to once every 100ms or so. I don't see a way to do this in the tcpdump manpage. Is there a way to do that?

I did see that you can adjust the buffer size using -B, but when I try to execute the following with a test python script (that simply outputs what it reads on stdin):

$ sudo tcpdump -i wlan0 -e -s 64 -n -j adapter -K -B 64 -l | python test.py

I get nothing but blank lines output to the terminal. I don't understand how the buffer works, because if I don't pipe it to a script the output to the terminal works fine using:

$ sudo tcpdump -i wlan0 -e -s 64 -n -j adapter -K -B 64 -l

(Python script):

import sys

while True:
    print sys.stdin.readline()

Can someone explain if there is a way to effectively limit the number of packets per second from each IP address that are output, and if not, how the -B option works, and if it can be piped to a python script like this?

0

After trial and error, I found out that if I tried anything lower than 256 in the -B option, it would fail. So in case this helps anyone else, use at least -B 256

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.