October 31, 201312 yr Wireshark is my preferred method of capturing files but it does take more resources (CPU and Memory) then a command line based tool like tcpdump. It would be best to look at the manpage for all the options but I will give you the example below that I use on a regular basis which will continuously create 20Mb files and once 1000 files get created it will begin overwriting files. sudo tcpdump -i eth0 -nnvv -w /home/hosangit/captures/ustrocapture.log -W 1000 -C 20,000,000 Now that you have all these files here are a few tools you can use to analyze the data Wireshark tshark (tshark -i eth0 -b filesize:20000 -b files:1000 -n -t ad -w /home/hosangit/captures/filename.cap) tcpdstat ipsumdump Netdude I will include examples with each of these as I put them together with some screen shots.
Create an account or sign in to comment