1

I have a file with packets captured by tcpdump over the span of a few days. From this file I would like to look at packets captured over a specific time duration spanning just a couple of hours.

I know that I can use tcpdump -r to read packets from a file. And I can use all the usual filters such as filtering by protocol and port number. I also know that I can use -c to limit how many packets will be output. But that won't allow me to skip a number of packets from the beginning.

I could use tcpdump -tttt and then grep for the time range I am interested in, but in the end I'd like to write the packets to a new (smaller) file with -w, and grep cannot help me with that.

Is there any way to instruct tcpdump to only include packets from a specific time interval?

| improve this question | |
  • There's a command-line program called editcap that is part of the wireshark family. Supposedly it can filter by time range, and output back to pcap format. See this question on StackOverflow for more info: stackoverflow.com/questions/19952991/… – dogoncouch Feb 17 '18 at 18:37
  • @dogoncouch I shall give that a try. I am somewhat baffled by the number of dependencies. When I instruct apt to install it I am told about more than 100 dependencies which will need to be installed as well. – kasperd Feb 17 '18 at 18:51
  • @dogoncouch That tool does the job. Would have been nice if I could filter by both time and expression with a single tool, but I can get by without that. If you put that comment as an answer I will accept it (unless something better shows up). – kasperd Feb 17 '18 at 19:03
2

There is a command-line tool called editcap (part of the wireshark family) that can filter pcap files by time range. There's more info in the answers to this question on StackOverflow:

https://stackoverflow.com/questions/19952991/filter-a-pcap-dump-file-for-a-specific-time-range#19955700

There is also a tool called logdissect that can filter tcpdump terminal output, and output to tcpdump's terminal output format, or json (with some basic fields like source/destination host, protocol, datestamp). It can't output to pcap, unfortunately, but if you don't need pcap output it can filter by a lot of different criteria. It is available on pip (python preferred installer), and it's on github with setup instructions.

Just for the sake of full disclosure, I wrote logdissect. I normally don't mention my own projects here, but it might help in this situation.

| improve this answer | |
  • I ended up using editcap to extract the time interval of interest and after that I used tcpdump to filter on port number. It turns out that the wireshark-common package which contains editcap has 100 dependencies because the package also contains graphical tools. It turns out that running apt install libwiretap6 and copying editcap from a machine that already had Wireshark installed allowed installing editcap without installing all the graphical tools. – kasperd Feb 17 '18 at 22:35
  • 1
    @kasperd That is very good to know. It does seem odd to not offer the CLI tools as a standalone. – dogoncouch Feb 17 '18 at 22:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.