I have a file with packets captured by
tcpdump over the span of a few days. From this file I would like to look at packets captured over a specific time duration spanning just a couple of hours.
I know that I can use
tcpdump -r to read packets from a file. And I can use all the usual filters such as filtering by protocol and port number. I also know that I can use
-c to limit how many packets will be output. But that won't allow me to skip a number of packets from the beginning.
I could use
tcpdump -tttt and then
grep for the time range I am interested in, but in the end I'd like to write the packets to a new (smaller) file with
grep cannot help me with that.
Is there any way to instruct
tcpdump to only include packets from a specific time interval?