Searching through captured packets

hershey101 · 06-19-2008, 03:45 PM

Hi,
I am new at UNIX and programing in general and only have a basic knowledge of C++. I am helping out with some research at a college and was given the task to sort through captured packets via IP addresses. I was wondering if anyone could help me with writing a code which filters through pcap files by ip addresses and then records the timestamps. I know a few programs that do this type of thing such as WireShark but they take up too much memory when analyzing gigabytes of data and that is why I am looking to write a relatively simple code which just gets my task done and gathers data for me. Please email me at <e-mail address removed>, any help is appreciated.

**Cellus** · 06-22-2008, 12:31 AM

WireShark has a CLI function for dumping and analyzing captured packets called tshark. You can find the online man page here.

hershey101 · 06-23-2008, 06:53 AM

I have heard of Wireshark however there are several problems with that program since it takes up a lot of memory which makes it impossible to analyze large pcap files (I will be working with files upto a few hundred gigabytes) and it becomes too tedious when I am trying to find patterns using hundreds of different IP addresses. I was thinking something more along the lines of using a separate text file for the IP addresses and some how use the 'tcpdump -r myfile.pco -w out.pcap ip src "1.2.3.4"' command to make it so that it matches the IPs with the text file. Also I am only interested in the time stamps and don't require the rest of the details of the packets, so it would be helpful if I wrote a code which filters through the clutter and gives me only the time stamps.
Thank You

06-19-2008, 03:45 PM	#1 (permalink)
hershey101 Registered User Join Date: Jun 2008 Posts: 4 OS: xp, vista, ubuntu, linux	Searching through captured packets Hi, I am new at UNIX and programing in general and only have a basic knowledge of C++. I am helping out with some research at a college and was given the task to sort through captured packets via IP addresses. I was wondering if anyone could help me with writing a code which filters through pcap files by ip addresses and then records the timestamps. I know a few programs that do this type of thing such as WireShark but they take up too much memory when analyzing gigabytes of data and that is why I am looking to write a relatively simple code which just gets my task done and gathers data for me. Please email me at <e-mail address removed>, any help is appreciated. Last edited by Cellus; 06-22-2008 at 12:30 AM. Reason: removed e-mail address to protect you against the tyranny of spambots everywhere

06-22-2008, 12:31 AM	#2 (permalink)
Cellus Moderator Networking Team Join Date: Aug 2006 Location: Canada Posts: 2,664 OS: Windows Vista Business SP1, Windows XP Professional SP3 My System	Re: Searching through captured packets WireShark has a CLI function for dumping and analyzing captured packets called tshark. You can find the online man page here. __________________ TSF Networking Team Virus/Trojan/Spyware Removal Help Donate!

06-23-2008, 06:53 AM	#3 (permalink)
hershey101 Registered User Join Date: Jun 2008 Posts: 4 OS: xp, vista, ubuntu, linux	Re: Searching through captured packets I have heard of Wireshark however there are several problems with that program since it takes up a lot of memory which makes it impossible to analyze large pcap files (I will be working with files upto a few hundred gigabytes) and it becomes too tedious when I am trying to find patterns using hundreds of different IP addresses. I was thinking something more along the lines of using a separate text file for the IP addresses and some how use the 'tcpdump -r myfile.pco -w out.pcap ip src "1.2.3.4"' command to make it so that it matches the IPs with the text file. Also I am only interested in the time stamps and don't require the rest of the details of the packets, so it would be helpful if I wrote a code which filters through the clutter and gives me only the time stamps. Thank You