1

I have a large tcpdump file which I need to parse to identify the number of flows in the capture based on the ( source ip + source port , destination ip + destination port ) pairs. Does tcpdump / any other tool provide any means to obtain such data directly? / Any tips on how to optimize my parser to perform this operation? Any help / leads are very much appreciated. Thanks.

1 Answer 1

2

Try something like this:

tcpdump -r capturefile.dmp | awk '{ print $3 " " $5 "\n" }' | sort | uniq | wc -l

Assuming your tcpdump generates the same output as mine, the awk command will print the source IP+port and the destination IP+port (followed by a colon, which is irrelevant in this case), like so:

zangetsu.smcc.loc.56256 scfire-a28.websys.aol.com.http:

Since an established connection will use the same portnumbers again you collapse these repeated lines with sort | uniq; wc -l counts the lines. You will have to divide this number by 2 since IP is bidirectional and it reverses source/destination when sending packets back.

You may want to filter out unwanted packets for UDP and ICMP and whatnot with tcpdump filters, and other stuff with a grep before sort.

1
  • Good answer, but the "\n" adds one extra flow. Also the flow is bidirectional so might need to handle tuple order.
    – Elad Weiss
    May 18, 2017 at 8:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .