1

I am processing the output of tcpdump on Ubuntu 16.04LTS using the following command:

$ sudo tcpdump -i wlan0 -e -s 64 -n -j adapter -K -l | python script.py

This works, but unfortunately, there are too many packets to handle for the scripts I want to write, so I would like to remove packets that are coming from the same IP address to once every 100ms or so. I don't see a way to do this in the tcpdump manpage. Is there a way to do that?

I did see that you can adjust the buffer size using -B, but when I try to execute the following with a test python script (that simply outputs what it reads on stdin):

$ sudo tcpdump -i wlan0 -e -s 64 -n -j adapter -K -B 64 -l | python test.py

I get nothing but blank lines output to the terminal. I don't understand how the buffer works, because if I don't pipe it to a script the output to the terminal works fine using:

$ sudo tcpdump -i wlan0 -e -s 64 -n -j adapter -K -B 64 -l

(Python script):

import sys

while True:
    print sys.stdin.readline()

Can someone explain if there is a way to effectively limit the number of packets per second from each IP address that are output, and if not, how the -B option works, and if it can be piped to a python script like this?

1 Answer 1

0

After trial and error, I found out that if I tried anything lower than 256 in the -B option, it would fail. So in case this helps anyone else, use at least -B 256

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .