Long term traffic capture with tcpdump over netcat

jonathanbaird

Hi,

I am looking to set up some long term traffic capture with tcpdump. I will need tcpdump to run when pfSense boots and I need it to write the output to a remote file over a netcat session. I am using the following command on the pfSense machine.

tcpdump -s 0 -U -n -i em0 -w - 'not port 9999' | nc 82.70.8.X 9999

And I am using the following command on a Windows machine receiving the output from tcpdump.

netcat-1.11>nc -l -p 9999 > tcpdump.pcap

This is working fine, and I am successfully saving the traffic to a pcap file on the Windows machine. The only problem I have is as I need to leave this running, the pcap file will simply get bigger and bigger. I have tried the -C option but as the file is not being written locally, it seems to be ignored. Is there any way I can set a file size limit on this so that once a file reaches say 100MB, a new file is generated? I assume the limit would need to be set on the destination side, in this instance on the Windows machine but I am not sure exactly how to achieve this.

Any help would be much appreciated.

Thank you in advance.

Jonathan.

heper

No answer for you question but wouldnt it be easier to setup a SPAN port on your switch, then capture directly on the windows device?

jonathanbaird

@heper:

No answer for you question but wouldnt it be easier to setup a SPAN port on your switch, then capture directly on the windows device?

This would be a lot easier, the problem is I am running this in a VMware vCloud Director environment which is located at a datacentre and I have no access to any physical hardware at all.

jimp

The problem here is more of a standard UNIX utility and not specific to pfSense.

That said, you might want to utilize something like tee(1), split(1) or some combination to achieve the desired result.

GruensFroeschli

As in the original thread:
https://forum.pfsense.org/index.php?topic=107605.msg599270#msg599270

You can pipe the output of nc on your receiving machine into wireshark.
Wireshark has the option to store a capture directly to a file and split the files at given intervals.
Take a look at the wireshark man page: https://www.wireshark.org/docs/man-pages/wireshark.html
you need arguments along the line of:


nc -l -p 12345 | wireshark -k -i - -w /path/to/some/file -b filesize:100000

Guest

I am looking to set up some long term traffic capture with tcpdump.

Only if needed

the pcap file will simply get bigger and bigger.

I would recommend not to go over a limit of 2 GB for each file either you have a really strong and
good sorted PC or Server where the files have to be viewed.

NOYB

plink, ssh , wireshark and tcpdump remote auto start.

https://forum.pfsense.org/index.php?topic=89917.msg497700