sun snoop and multi file output

Question

Is there any way snoop can cut output files every "x" minutes or every "y" Mbyts? thanks

Answer 1

You can't do this directly but you can capture to a file and then use something like editcap that comes with wireshark (available from sunfreeware )to split the file into multiple parts.

snoop -o pkts.cap
^C
editcap -i 300  pkts.cap cap_split

would split the original capture file into 5 minute blocks cap_split*.