When running the following command
tcpdump -i deviceName 'host 184.108.40.206' -q -w /mypath/dump.pcap
the dump file contains a huge amount of data because there's a lot of traffic. However, I only need to save the header details of each packet, not the entire contents. I tried using the
-q switch (for "quiet") but that's not helping.
I need Time, Source, Destination, Protocol and Length. I do not need any of the other information, and especially not the full contents of each packet.
If there's a way to ignore the contents and only write the header details to disk so as to save space? I'm getting to over a GB in a matter of minutes :(
I've seen many questions about how to increase the amount of data saved, but nothing for reducing it. Am I barking up the wrong tree?