Linux in a Nutshell, Fifth Edition

466

|

Chapter 3: Linux Commands

This is the Title of the Book, eMatter Edition

Copyright © 2006 O’Reilly & Associates, Inc. All rights reserved.

Examples

Place full packets into a file named tcpdump.cap for later analysis:

tcpdump -v -w tcpdump.cap -xX -s 0

Read all packet headers received on the eth0 interface, except for

arp and SSH packets:

tcpdump -i eth0 not arp and not port ssh

tcpslice

tcpslice [options] [start [end]] files

System administration command. Reads and manipulates packet

capture files created by tcpdump -w. Based on timestamps, extract

portions of or piece together files. Display all packets between the

given start and end times. tcpslice understands most time and date

formats. tcpslice also understands a relative time format specified

as a unit of time—e.g., +1h10m to specify the first hour and ten

minutes of packets in the specified files. This format is named

ymdhmsu after the letters it uses to denote units of time: years,

months, days, hours, minutes, seconds, and microseconds. If no

constraining dates are specified, the command will print out all

packets contained in files.

Options

-d Print the start and end time of the specified range, then exit.

-r Print the time and date of the first and last packet in each file,

then exit.

-R Print the raw timestamp of the first and last packet in each file,

then exit.

-t Print times associated with the first and last packet in each file

in ymdhmsu ...