I want to use capture filter to get all the cflow (Netflow) templates that are being sent by a router. I can use "host 1.2.3.4" as capture filter to filter out other IPs, but how to use cflow.templateid in capture filter section.. Basically router would be sending millions of flows on some UDP port 9995 and I want to run it for atleast a day. Wireahrk would hang if I only use "host" filter since the captured data is too huge. asked 22 May '16, 22:05  Satya_Mokalla |
One Answer:
Display filter allows more detailed filtering than capture filter because it uses the results of packet dissection. Packet dissection consumes memory to maintain state information about the packet flows. Therefore, the best way to capture high volumes of traffic is to use dumpcap and post-process its output files which can be done multiple times. More details can be found here. If you can identify some byte patterns at fixed positions in the cflow payload and the cflow PDUs always fit into a single packet, you may be able to look for these patterns using a capture filter. To find the syntax necessary for an advanced case like yours, where you need to look into tcp payload which may be located at different offsets depending on the presence of tcp options, search for "Capture HTTP GET requests" at this page. answered 23 May '16, 00:57  sindy |
