0

We are running offline network analysis by capturing packets to files and analyzing afterwards with automated system.

Our Wireshark @ Ubunty command line looks like:

wireshark -k -i eth0  -y EN10MB -b duration:900 -b filesize:1024 -n -w /home/mss2/Capture/packets/ubuntlive1mb -f 'ip and (net X.X.X.X/22)'

A week ago traffic increased twice in volume so we have drive space issues. As a temporarily solution we are deleting every second file as this will not affect overall stats (percentages of traffic types) that bad.

I wonder is there the way to tell wireshark (or maybe other program?) to capture not all by every second packet?

Improve this question

1 Answer 1

Reset to default
2

While this does not skip alternate packets, it will help with capture size.

Using the -s option will allow you to only capture the first part of the packet. For example -s 84 should give you all the headers down to TCP. If you're not troubleshooting down in to the application the that should be enough. You could do -s 128 to capture the first part of the application headers of you like too.

For more information go to wiki.wireshark.org/SnapLen

Improve this answer
3
  • The BPF capture filter (the only viable option, if at all) has no temporal state, therefore cannot filter in the way requested. This described option is the viable way to reduce capture size, while maintaining relevant data.
    – Jaap Keuter
    Aug 24, 2016 at 11:01
  • @Jaap Keuter : what is BPF capture filter?
    – Anton Krouglov
    Sep 2, 2016 at 21:17
  • BPF is the underlying filter system for Wireshark/tcpdump.
    – imlepid
    Sep 2, 2016 at 22:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.