0

I need to dump network flow periodically on a Linux platform, ideally using the command line interface (i.e., non-GUI tools), and I want every capture file (pcap files) to contain complete flows. How can I do this? (Is this possible via tcpdump?)

EDIT: for example, when receiving a file via ftp or http ,if the file is divided into , say, 10 packets, I want all packets and the headers to be in the same dump file.It would also be helpful if I could dump each flow in pcap format in a single file.

2
  • Yes, probably, and probably in a few ways, depending on what you want. tcpdump can do rolling captures, were it only keeps specified segments as it captures and just starts rolling over them after they get large enough (look at man page), or you could script a wrapper around tcpdump to be more precise in how you take and manage captures. There probably are pre-built tools for this though, but that really isn't in the scope of this forum to be asking for recommendations.
    – MaQleod
    Apr 3, 2017 at 17:27
  • 1
    To be clear: Are you saying that, if user Joe logs in to SSH server X at 8 AM and stays logged in until 5 PM, you want that entire session to be captured in one file, even though you’re starting a new dump file every four hours? If so, that sounds like something that might be very difficult; I look forward to seeing the answers. Please do not respond in comments; edit your question to make it clearer and more complete. Apr 3, 2017 at 18:02

1 Answer 1

-1

Please follow the below URL http://www.cs.wustl.edu/~jain/cse567-06/ftp/net_traffic_monitors3/ , may be it is useful

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .