I have a large tcpdump file which I need to parse to identify the number of flows in the capture based on the ( source ip + source port , destination ip + destination port ) pairs. Does tcpdump / any other tool provide any means to obtain such data directly? / Any tips on how to optimize my parser to perform this operation? Any help / leads are very much appreciated. Thanks.
1 Answer
Try something like this:
tcpdump -r capturefile.dmp | awk '{ print $3 " " $5 "\n" }' | sort | uniq | wc -l
Assuming your tcpdump generates the same output as mine, the awk command will print the source IP+port and the destination IP+port (followed by a colon, which is irrelevant in this case), like so:
zangetsu.smcc.loc.56256 scfire-a28.websys.aol.com.http:
Since an established connection will use the same portnumbers again you collapse these repeated lines with sort | uniq
; wc -l
counts the lines. You will have to divide this number by 2 since IP is bidirectional and it reverses source/destination when sending packets back.
You may want to filter out unwanted packets for UDP and ICMP and whatnot with tcpdump filters, and other stuff with a grep
before sort.
-
Good answer, but the "\n" adds one extra flow. Also the flow is bidirectional so might need to handle tuple order. May 18, 2017 at 8:31