Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an hour long PCAP file which has about 60 individual network attacks done on our test network here at work. Each attack comes from a unique IP address which was not used elsewhere during the hour.

I'd like to make 60 pcaps out of this one file, but also include the background traffic as well.

There's no real pattern to when the attacks occur (i.e. there could be 6 in the first minute, and then 1 could run for the next 10 minutes).

I can separate into files which just capture the attack, but I'm really interested in having the background traffic there as well.

To clarify my reason for needing this, I am using this data to attempt to train a machine learning based network sensor.

share|improve this question
So you want to separate them into timeframes that the attacks occurred? Check out tshark – resmon6 Apr 30 '12 at 17:19
What do you mean by "background traffic"? Are the attack source IPs in a single subnet? – mgorven May 1 '12 at 0:43
@resmon6 Yes, I want to separate them into timeframes, but I don't have consistent time intervals which work for this. I've looked at tshark and editcap, but neither provide the functionality I need. I ended up manually finding good times to cut the pcap and then using tshark to cut at those times. – Evan May 1 '12 at 5:48
@mgorven The pcap is from the entrance router to a /24 subnet which is communicating with several other subnets on the network. The attacks are coming from a unique /24, but I want to include the non-attack traffic in each individual pcap and not just the traffic from the unique attacking IP. – Evan May 1 '12 at 5:50
up vote 4 down vote accepted

Assuming that you have the list of attack IPs in a file named attack-ips, the raw dump in capture.pcap, and that the attack range is, the following script using tcpdump should accomplish this:

while read ATTACKIP; do
    tcpdump -n -r capture.pcap -w "$ATTACKIP.pcap" "host $ATTACKIP or not net"
done < attack-ips

The filter selects traffic which is either to or from the attack IP, or neither to nor from the attack range (to exclude all the other attack IPs).

share|improve this answer
Thanks, this is simple and easy way to go about it. Do you know a way to pull the time from the last occurrence of a particular IP? – Evan May 1 '12 at 6:15
tcpdump -n -r capture.pcap host $ATTACKIP | tail -n1 | awk '{print $1}' – mgorven May 1 '12 at 6:24
Awesome. I need to get better at using the tools at my disposal. This helps immensely. – Evan May 1 '12 at 6:36

SplitCap can split the packets for each individual IP address to a separate pcap files in just one command:

SplitCap.exe -r capture.pcap -s host

You will have one pcap file for each IP address in capture.pcap after this. Each file will contain all packets to and from that particular IP address. Sweet and simple!

SplitCap is free and is available here:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.