0

The following is the output from my PCAP file.

20:02:52.306161 192.162.70.150.58078 > 192.179.91.61.1194: P 635362993:635363048(55) ack 2046024708 win 4373 <nop,nop,timestamp 52993632 1059054949> (DF)
20:02:52.532863 192.179.91.61.1194 > 192.162.70.150.58078: . ack 55 win 32038 <nop,nop,timestamp 1059062357 52993632> (DF)
20:02:53.157004 802.1d unknown version
20:02:54.759542 arp who-has 192.168.70.34 tell 192.168.70.1
20:02:55.156980 802.1d unknown version
20:02:55.759507 arp who-has 192.168.70.6 tell 192.168.70.1
20:02:55.759540 arp who-has 192.168.70.105 tell 192.168.70.1
20:02:56.148167 192.179.91.61.1194 > 192.168.70.150.58078: P 1:56(55) ack 55 win 32038 <nop,nop,timestamp 1059065972 52993632> (DF)
20:02:56.148258 192.168.70.150.58078 > 192.179.91.61.1194: . ack 56 win 4373 <nop,nop,timestamp 52994592 1059065972> (DF)

Is there a way to filter out the contents in following pattern

Timestamp | source IP | source Port | destination IP | destination port | protocol | packet size

Available commands: tcpdump, tcpslice, tcpstat, tcpprof, tcpparse

3
  • Can you show the desired output for this example file content? – AdminBee Sep 10 '20 at 13:56
  • You should not post the same question on two SE sites. See meta.stackexchange.com/questions/64068/… – A.B Sep 13 '20 at 0:38
  • And what should that give for the non-IP packets like the ARP/802.1d packets here. By "protocol", do you mean transport protocol on top of IP for those that are so (tcp/udp/sctp/icmp...)? By packet size do you mean the size of the frame as captured by tcpdump (including link layer and IP headers) or just the payload of those frames (so for IP packets, including the IP header and payload (including TCP/UDP header)) or the IP payload or the transport protocol payload? – Stéphane Chazelas Oct 22 '20 at 12:09
1

To analyze the tcpdump from command line, tcpparse command can be used. Eg:

# tcpparse tcpdump_file.pcap

6 192.135.33.41 132 > 192.168.20.119 1544 74
6 192.168.20.119 57604 > 192.135.33.41 1194 66
6 192.168.20.119 57604 > 192.135.33.41 1194 110
6 192.135.33.41 1194 > 192.168.20.119 57604 66
6 192.135.33.41 1194 > 192.168.20.119 57604 122
6 192.168.20.119 57604 > 192.135.33.41 1194 66
6 192.168.20.119 57604 > 192.135.33.41 1194 118

Columns explained :-

  1. protocol
  2. source IP address
  3. source port
  4. destination IP address
  5. destination port
  6. packet size.

Similarly tcpdump -r can also be used.

0

You'll have a better time loading your capture file into wireshark which will neatly do it for you in the "conversations" window.

Otherwise, have a look at this thread: https://serverfault.com/questions/273066/tool-for-splitting-pcap-files-by-tcp-connection

2
  • Unfortunately, I cannot install any other tools/commands, thats why I have listed down the available commands that can be used. – Gautham Sreenivasan Sep 10 '20 at 13:35
  • Can't you transfer the PCAP file to your computer for analysis with Wireshark ? If that's not an option either, then you could write a python script to parse the capture file (there are modules for that purpose), but you'll need Python to be installed on the machine. – JoDeref Sep 10 '20 at 13:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.