Viewing Multiple Capture Files With tcpdump
In the course of some troubleshooting yesterday, I had to capture some packets on our external Internet interface. In order to keep the files manageable, I set up wireshark to use 10 megabyte files. That wasn't the best idea, since it resulted in a new file every 8-10 seconds, and overwhelmed this little Thinkpad I use. Oh, well.
In the end, one of the things I wanted to see is how many ICMP unreachable messages were sent by the firewall in that time frame. I have 530 10 megabyte files from the capture, and I really didn't want to open every one in wireshark and then scroll down the packet list, or even filter for unreachables. I tried a couple of command-line options with tcpdump, using xargs and bash scripts, but these options were either too complicated for regular use, or just didn't work.
In the end, I stumbled on mergecap, a command-line utility included with wireshark. Its intended purpose is to, surprise, merge a bunch of capture files, but I didn't want a 530 megabyte capture file to then work with, either. It turns out that you can use stdin and stdout to have mergecap output to stdout, and have tcpdump grab it for immediate display.
In the end, I came up with:
That's quick and easy enough to use all the time.
In the end, one of the things I wanted to see is how many ICMP unreachable messages were sent by the firewall in that time frame. I have 530 10 megabyte files from the capture, and I really didn't want to open every one in wireshark and then scroll down the packet list, or even filter for unreachables. I tried a couple of command-line options with tcpdump, using xargs and bash scripts, but these options were either too complicated for regular use, or just didn't work.
In the end, I stumbled on mergecap, a command-line utility included with wireshark. Its intended purpose is to, surprise, merge a bunch of capture files, but I didn't want a 530 megabyte capture file to then work with, either. It turns out that you can use stdin and stdout to have mergecap output to stdout, and have tcpdump grab it for immediate display.
In the end, I came up with:
mergecap -w - capfile* | tcpdump -n -tttt -r - | grep -i unreachable
That's quick and easy enough to use all the time.
