1

Questions:

  1. Which tool you would use to network capture a network bridge and why? focused on performance? heat built-up? focused on configuration options?

  2. Is it possible to capture special ports like ONLY port 80/9100 (more or less) with one of these tools? what would be the best mode to do that? are there options to parse analysed data for keywords/domains/whatever or is this a scenario i have to do after capturing?

  3. Is it possible to save each data STREAM directly to a single file? e.g. stream of a captured printer job on 9100? (are there any other sites of SO discussing that kind of questions?)

kindly

Improve this question
2
  • 1
    "... to <del>network</del> capture a network bridge ..." I guess? What has nmap to do with this, do you mean tcpdump?
    – Lekensteyn
    Commented Feb 19, 2014 at 13:52
  • ..what a bloomer ;) you are completly right ;)
    – Alex Tape
    Commented Feb 20, 2014 at 8:18

2 Answers 2

Reset to default
2

I would use tcpdump because it is small (self + dependencies). You can specify a capture filter that restricts the capture, for example (assuming interface eth0):

tcpdump -w capture.pcap -i eth0 'tcp port 80 or tcp port 9100'

If you have wireshark installed, then an alternative command that produces a capture file in a newer format:

dumpcap -w capture.pcapng -i eth0 -f 'tcp port 80 or tcp port 9100'

A display filter can be used to limit the output of the data (replace wireshark by tshark for textual output instead of a GUI):

wireshark -r capture.pcap -Y 'http.host == example.com'

For real-time capture you can also combine these options (the filter option can also be specified in the UI so you could omit it from the command if you'd like to):

wireshark -w capture.pcapng -i eth0 -f 'tcp port 80 or tcp port 9100' -Y 'http.host == example.com'

Then to save a TCP stream, right-click on a packet and pick "Follow TCP stream". In the new window, you have the option to save the captured data.

Improve this answer
2
  • is it possible to do the last step "to save a TCP Stream" automatically? like: save all streams you recieved completly? and just for my understanding: a display filter is equivalent to grep on the output/stdout?
    – Alex Tape
    Commented Feb 20, 2014 at 10:01
  • 1
    @AlexTape A display filter can act on any property of the packet, it does much more than simply searching for a string. tshark has a -z follow,tcp,... option (see manpage) if you want to automate it, but last time I tried it, it was buggy. Anyway, to extract a certain field, you can try tshark -T fields -e tcp.segment_data -r some.pcapng. (look for other fields in the manual or tshark -G fields | grep something | column -t -s $'\t')
    – Lekensteyn
    Commented Feb 20, 2014 at 23:48
0

Both are useful tools and require installation of winpcap / libpcap, but Wireshark will be my choice.It has the most powerful display filters can do live capture and offline analysis. See more info from here their site.

Some other easy-to-use network traffic monitoring and analyzing tools. You can go for a try.

Colasoft Capsa Free - Network Analyzer

Angry IP Scanner - Network Scanner

Improve this answer
1
  • i know wireshark/tcpdump and their technique. the question is about what would be the best decision on rPi and how to directly filter/save the incoming network stream properly.
    – Alex Tape
    Commented Feb 20, 2014 at 8:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.