06-19-2008
searching through pcap files
Hi,
I am new at UNIX and programing in general and only have a basic knowledge of C++. I am helping out with some research at a college and was given the task to sort through captured packets via IP addresses. I was wondering if anyone could help me with writing a code which filters through pcap files by ip addresses and then records the timestamps. I know a few programs that do this type of thing such as WireShark but they take up too much memory when analyzing gigabytes of data and that is why I am looking to write a relatively simple code which just gets my task done and gathers data for me.
10 More Discussions You Might Find Interesting
1. UNIX for Dummies Questions & Answers
hi there
can anyone tell me how to search and copy files under unix?
im writing shell scripts with 'vi' and 'pico'
something like
read directoryName
if
then
echo Copying the files
copy those *.src files to sub1(another directory) using cp
else
... (4 Replies)
Discussion started by: nickaren
4 Replies
2. Programming
I cant use pcap.h include file. How can I do so? :confused: (8 Replies)
Discussion started by: Pervez Sajjad
8 Replies
3. UNIX for Advanced & Expert Users
Hi,
I have a file
/db01/dat/march 2006/7001DW06.03B
Please note, between "march 2006" there is a space/tab.
While running the following script, it identifies
/db01/dat/march ----> as first file
2006/7001DW06.03B ---> as second file.
SRC_PATH = /db01/dat
SEARCH_FILENAME =... (12 Replies)
Discussion started by: ronald_brayan
12 Replies
4. Shell Programming and Scripting
Can someone please help me figure out how to use pcap.h to sniff packets between only 2 computers whose mac addresses are know?
Thanks (0 Replies)
Discussion started by: papabearcares
0 Replies
5. UNIX for Dummies Questions & Answers
Hi,
I am new at UNIX and programing in general and only have a basic knowledge of C++. I am helping out with some research at a college and was given the task to sort through captured packets via IP addresses. I was wondering if anyone could help me with writing a code which filters through pcap... (1 Reply)
Discussion started by: hershey101
1 Replies
6. Programming
Hi all,
I'm writing a program using libpcap, and I have multiple pcap files in a folder that I want to capture.
I currently have
handle = pcap_open_offline("/data/traffic/pcap1.pcap", errbuf");
which works fine since pcap_open_offline() takes in a filename. However, I want to process... (0 Replies)
Discussion started by: lancer6238
0 Replies
7. Shell Programming and Scripting
I have a list of files in directory and i should write a script if any of these files contains words given in a text file test.txt. the words can be case ignored and word should match.
The output should be the name of the directory in which the file is present followed by list of file names
Eg:... (1 Reply)
Discussion started by: kinny
1 Replies
8. UNIX for Advanced & Expert Users
Hi, I have the following command to list files beginning with a specific name and containing some text...
find . -type f -name "dm_merge_domain_adm*" -exec grep -il "Error Message:" '{}' \; -print|xargs ls -ltr
It works fine, but seems to list two of each file, when they only exist once...any... (1 Reply)
Discussion started by: chrislluff1976
1 Replies
9. Shell Programming and Scripting
I have a list of pattern in a file, I want each of these pattern been searched from 4 files. I was wondering this can be done in SED / AWK.
say my 4 files to be searched are
> cat f1
abc/x(12) 1
abc/x 3
cde 2
zzz 3
fdf 4
> cat f2
fdf 4
cde 3
abc 2... (6 Replies)
Discussion started by: novice_man
6 Replies
10. Shell Programming and Scripting
i want to search a file bt it not happening i m using
#!bin/bash
read file
if (-e "$file")
then
echo "asfsafafa"
else
echo "NO SUCH FILE"
fi
....error
./VMC.sh: line 5: : command not found
NO SUCH FILE
;;;;;;;;;;
its giving correctly no such file found but whats is command not found. (7 Replies)
Discussion started by: console
7 Replies
LEARN ABOUT FREEBSD
pcap_compile
PCAP_COMPILE(3) Library Functions Manual PCAP_COMPILE(3)
NAME
pcap_compile - compile a filter expression
SYNOPSIS
#include <pcap/pcap.h>
int pcap_compile(pcap_t *p, struct bpf_program *fp,
const char *str, int optimize, bpf_u_int32 netmask);
DESCRIPTION
pcap_compile() is used to compile the string str into a filter program. See pcap-filter(7) for the syntax of that string. program is a
pointer to a bpf_program struct and is filled in by pcap_compile(). optimize controls whether optimization on the resulting code is per-
formed. netmask specifies the IPv4 netmask of the network on which packets are being captured; it is used only when checking for IPv4
broadcast addresses in the filter program. If the netmask of the network on which packets are being captured isn't known to the program,
or if packets are being captured on the Linux "any" pseudo-interface that can capture on more than one network, a value of PCAP_NET-
MASK_UNKNOWN can be supplied; tests for IPv4 broadcast addresses will fail to compile, but all other tests in the filter program will be
OK.
RETURN VALUE
pcap_compile() returns 0 on success and -1 on failure. If -1 is returned, pcap_geterr() or pcap_perror() may be called with p as an argu-
ment to fetch or display the error text.
SEE ALSO
pcap(3), pcap_setfilter(3), pcap_freecode(3), pcap_geterr(3), pcap-filter(7)
1 December 2009 PCAP_COMPILE(3)