Is it possible to capture only the first 10k of data in a TCP flow and discard the rest at capture time? I have a large number of TCP sessions where each session starts with some metadata and then proceeds with an enormous binary dump. I suspect an occasional problem in the metadata portion of the flow and want to capture it for study, but don't have enough resources to keep all of the bulk data segments around.
How would you set up such a capture?
I've found filters for segment length and total reassembled length, but the former is effectively just packet size and the latter doesn't increment each time the window is updated, it's calculated once for the entire flow. Maybe there is a way to do the math for the sequence numbers? I don't know how to do that in a capture filter though, not even in Wireshark's more powerful display filters. Maybe there is a better tool? I'm working on a Linux machine.