Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a large tcpdump file which I need to parse to identify the number of flows in the capture based on the ( source ip + source port , destination ip + destination port ) pairs. Does tcpdump / any other tool provide any means to obtain such data directly? / Any tips on how to optimize my parser to perform this operation? Any help / leads are very much appreciated. Thanks.

share|improve this question

1 Answer 1

Try something like this:

tcpdump -r capturefile.dmp | awk '{ print $3 " " $5 "\n" }' | sort | uniq | wc -l

Assuming your tcpdump generates the same output as mine, the awk command will print the source IP+port and the destination IP+port (followed by a colon, which is irrelevant in this case), like so:

zangetsu.smcc.loc.56256 scfire-a28.websys.aol.com.http:

Since an established connection will use the same portnumbers again you collapse these repeated lines with sort | uniq; wc -l counts the lines. You will have to divide this number by 2 since IP is bidirectional and it reverses source/destination when sending packets back.

You may want to filter out unwanted packets for UDP and ICMP and whatnot with tcpdump filters, and other stuff with a grep before sort.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.