This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi I want to capture traffic with tcpdump and I want to have a script that get as input a time and start capturing traffic with tcpdump and after the time stop the capturing.

can you help that how set for tcpdump or for a shellscript???

asked 08 Jun '14, 08:21

mosa's gravatar image

mosa
11446
accept rate: 0%


You don't need any script, if the following simple method is good enough for you.

The first command will schedule tcpdump at 15:30, using the command at (should be available on any Unix like system).

echo "/usr/sbin/tcpdump -ni eth0 -s0 -w /var/tmp/capture_eth0.pcap host 1.2.3.4 and port 80" | at 15:30

The second command will schedule the 'end' of tcpdump, by simply killing all running tcpdump processes 5 minutes later (15:35).

echo "killall tcpdump; killall tcpdump" | at 15:35

atq will show the jobs

atq
4 Thu Jun 12 15:35:00 2014 a surfer
3 Thu Jun 12 15:30:00 2014 a surfer

And at -c [jobid] will show the content of the jobs

at -c 3 | tail -1
tcpdump -ni eth0 -s0 -w /var/tmp/capture_eth0.pcap host 1.2.3.4 and port 80

at -c 4 | tail -1
killall tcpdump; killall tcpdump

If you need a solution for a more complex environment, you'll have to write a shell script that gets started with the at command (or by cron) and that kills only the tcpdump instance that was started by the script after some time (hint: SIGALRM). However, that's plain shell scripting and this is certainly the wrong place to ask for shell scripting tips ;-)

Regards
Kurt

permanent link

answered 12 Jun '14, 06:31

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 12 Jun '14, 06:47

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×75
×3

question asked: 08 Jun '14, 08:21

question was seen: 6,557 times

last updated: 12 Jun '14, 06:47

p​o​w​e​r​e​d by O​S​Q​A