Re: Protocol headers-only capture?

[Dustin Spicuzza <dustin () virtualroadside com>]

Dustin Spicuzza wrote:
> Guy Harris wrote:
> > On Dec 17, 2008, at 2:30 PM, Dustin Spicuzza wrote:
> >
> > > Speaking of which, is there something in tcpdump that can figure out how
> > > long the header is... I see that the printers figure out this
> > > information, but its not done separately as far as I can see.
> > No, it's not.
> >
> > If you could have the various link layers' if_print routines do
> > everything they do except for printing anything - or calling any other
> > printer routines - that'd do the job.
>
> Thats true. Sounds a bit more invasive/time-consuming than what I wanted
> to do originally.. I'll play with it this weekend if I have more time.
> Thanks.
>
> Dustin

So I have too much other stuff going on at the moment (especially with
the holidays, and changing *all* of the different link layers print
routines sounded really annoying (honestly though, thats pretty cool --
I never realized it supported so many different interfaces).

However, I cheated a bit and got this working last week with ethernet
frames (which is what I'm capturing on) and its been running all weekend
without a hitch, so if anyone else is interested in the patch I've
posted it online -- it works against stable and CVS:

http://www.virtualroadside.com/download/tcpdump-4.0.0.patch.tar.gz

With the patch, you can do something like

tcpdump -i eth0 -s headers -z gzip -G 1800 -w /data/%Y%m%d@%H%M.pcap

And it will rotate the logs around every half hour storing only headers.
 Of course the only part I did was add the -s headers option..

Thanks for your help!

Dustin



-- 
Innovation is just a problem away

Attachment: signature.asc
Description: OpenPGP digital signature