I am processing the output of tcpdump on Ubuntu 16.04LTS using the following command:
$ sudo tcpdump -i wlan0 -e -s 64 -n -j adapter -K -l | python script.py
This works, but unfortunately, there are too many packets to handle for the scripts I want to write, so I would like to remove packets that are coming from the same IP address to once every 100ms or so. I don't see a way to do this in the tcpdump manpage. Is there a way to do that?
I did see that you can adjust the buffer size using
-B, but when I try to execute the following with a test python script (that simply outputs what it reads on stdin):
$ sudo tcpdump -i wlan0 -e -s 64 -n -j adapter -K -B 64 -l | python test.py
I get nothing but blank lines output to the terminal. I don't understand how the buffer works, because if I don't pipe it to a script the output to the terminal works fine using:
$ sudo tcpdump -i wlan0 -e -s 64 -n -j adapter -K -B 64 -l
import sys while True: print sys.stdin.readline()
Can someone explain if there is a way to effectively limit the number of packets per second from each IP address that are output, and if not, how the -B option works, and if it can be piped to a python script like this?