Is there any way snoop can cut output files every "x" minutes or every "y" Mbyts?
You can't do this directly but you can capture to a file and then use something like editcap that comes with wireshark (available from sunfreeware )to split the file into multiple parts.
snoop -o pkts.cap
editcap -i 300 pkts.cap cap_split
would split the original capture file into 5 minute blocks cap_split*.
Sign up using Google
Sign up using Facebook
Sign up using Stack Exchange
3 years ago