Suppose I am capturing packets on a remote host with tcpdump (more precisely, I'm doing it with an Endace card, which exposes a tcpdump-like utility called dagsnap).

What would be a fast way to stream the captured traffic in a lossless way onto my local host with inline compression?

The best naive approach I can think of is instead of writing to disk, have the remote host pipe the output to lz4, then pipe the compressed output onto a TCP connection to the local host established with netcat.

Is there a faster approach?

  • 1
    what are you capturing? if only certain metrics then something like netflow/sflow/ipfix might make more sense – thrig May 2 '18 at 1:49
  • Well, if you're streaming it through ssh, then ssh -C would be a simple & effective method. – Patrick May 2 '18 at 4:10
  • @Patrick Didn't know about -C flag for ssh, that's cool, I'm not streaming it through ssh though. – elleciel May 2 '18 at 14:30
  • @thrig I'm capturing all firewall traffic. – elleciel May 2 '18 at 14:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.