This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I'm looking for a feature to trigger a capture from either tcpdump or tshark I have a setup where a capture easily could take up giga bytes. So what I need is some kind of trigger which would cause a capture to start when ex a SIP invite to a certain URI is detected, and then capture the next 100M

Is this somehow possible?

asked 31 Jan '11, 16:02

Kjeld%20Flarup's gravatar image

Kjeld Flarup
6448
accept rate: 0%


As far as I know that is on the wish list of features for quite some time now, but doesn't exist in Wireshark yet. You could go for setting up a ring buffered capture that overwrites older trace files. If you set the buffer large enough you might be able to capture what you want and have enough time to find out about it without overloading your disk.

Finding the SIP invite in tons of trace data isn't that hard using tshark, using the "-r <infile> -R "<filter for the sip invite>" -w <outfile>" syntax in a batch on all captured files and checking if a call was found by looking into the outfile. Then track down the full trace by looking at absolute date and time and extract it.

permanent link

answered 31 Jan '11, 16:52

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Thanks Jasper

Although I cannot use the ring buffer either, you gave me an idea to emulate this. Currently I have put a packet limit on the tcpdump, and when that exceeds I restart it with a new file name.

I could of course run a filter when it restarts I could check if I got my data, and delete the old file if not use able.

(01 Feb '11, 13:53) Kjeld Flarup
1

(I changed your answer to a comment to adhere to the Q&A style of this website)

You can also use the "-C <size>" option of tcpdump, it will create a new file after each <size> million bytes. You can then run a cleaning script that deletes all files but the latest <x> ones. That will create a "ring-buffer" of X*size MB :-)

(lets call it a "poor-mans-dumpcap-ringbuffer" :-))

(02 Feb '11, 10:58) SYN-bit ♦♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×549

question asked: 31 Jan '11, 16:02

question was seen: 5,677 times

last updated: 02 Feb '11, 10:58

p​o​w​e​r​e​d by O​S​Q​A