4 ms·
Aren't tcpdump and wireshark some pretty interfaces to libpcap? Also linking the home page of tcpdump/libpcap [1], and check the documentation about the packet
by ccozan 11y ago
Aren't tcpdump and wireshark some pretty interfaces to libpcap? Also linking the home page of tcpdump/libpcap [1], and check the documentation about the packet capturing.
[1] http://www.tcpdump.org/ http://www.tcpdump.org/
- viraptor 11y agoThey're intelligent interfaces to libpcap. If you have a pretty interface, you get nice opaque data you'll have to understand yourself. With intelligent interface you can do high-level processing like "I only want to see GET requests". But they're still fairly stateless... without some extra scripting you cannot do a query for "TCP connections with more than 3 restarts".
- ccozan 11y agoWhat I meant with pretty, is pretty for human eyes, unless you are able to read TCP/IP headers ( for example ) directly in hexa. Regarding ther other topic, nothing stops someone to capture the packets to a generic DB ( sqlite or berkleydb ) to operates such queries. Looks like a weekend project!