I have a file with packets captured by tcpdump
over the span of a few days. From this file I would like to look at packets captured over a specific time duration spanning just a couple of hours.
I know that I can use tcpdump -r
to read packets from a file. And I can use all the usual filters such as filtering by protocol and port number. I also know that I can use -c
to limit how many packets will be output. But that won't allow me to skip a number of packets from the beginning.
I could use tcpdump -tttt
and then grep
for the time range I am interested in, but in the end I'd like to write the packets to a new (smaller) file with -w
, and grep
cannot help me with that.
Is there any way to instruct tcpdump
to only include packets from a specific time interval?
apt
to install it I am told about more than 100 dependencies which will need to be installed as well.