0

When running the following command

tcpdump -i deviceName 'host 1.2.3.4' -q -w /mypath/dump.pcap

the dump file contains a huge amount of data because there's a lot of traffic. However, I only need to save the header details of each packet, not the entire contents. I tried using the -q switch (for "quiet") but that's not helping.

I need Time, Source, Destination, Protocol and Length. I do not need any of the other information, and especially not the full contents of each packet.

If there's a way to ignore the contents and only write the header details to disk so as to save space? I'm getting to over a GB in a matter of minutes :(

I've seen many questions about how to increase the amount of data saved, but nothing for reducing it. Am I barking up the wrong tree?

  • 1
  • 1
    See option -s snaplen or --snapshot-length=snaplen. See tcpdump.org/manpages/tcpdump.1.html. They seem to have increased the default. (I remember that in old times I often had to increase the value which was less than 100 at this time.) – Bodo Mar 27 at 12:20
  • I was under the impression that snaplen would only record information regarding packets below a certain size, not that it would limit what was saved to file. I'll take a look and get back to you. Thanks guys. – Dan Rayson Mar 27 at 12:37
  • Local login or remote ssh session? – Rui F Ribeiro Mar 28 at 0:43
  • @RuiFRibeiro I'm running the commands using PuTTY, if I'm honest I don't know what protocol that is, probably SCP, though. – Dan Rayson Mar 28 at 10:13
1

I was in the same situation and I solved it by adding -s 96

  • Thanks Zatarra, adding this really simple bit sorted it out for me. I still get all the info I need but without the nasty overhead. Cheers! – Dan Rayson Mar 27 at 13:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.