0

i am currently running tcpdump with the following command 

tcpdump -r input.pcap -w output.pcap -F /filter_file

the problem is that tcpdump throws this error

tcpdump: out of memory

and i am unable to find any solution through google.
please note that the size of the filter is 630Kb

thank you for any input

Improve this question
3
  • 300 Kbyte is unusual: could you tell us more about the filter?
    – jonathanjo
    Apr 4, 2018 at 8:49
  • the file contains almost 35000 ports to filter, and sorry its my mistake the file size is close to 600 kb (saw a different filter before)
    – Anivos
    Apr 4, 2018 at 9:46
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin ♦
    Dec 25, 2018 at 8:14

1 Answer 1

Reset to default
1

Whilest completely agreeing none of these are entirely satisfactory, here are some thoughts which might help, gleaned from doing various large-scale packet-capture analyses over the years.

Perhaps one of these ideas will help you:

  • Is it possible to simplify this match conditions somehow, perhaps there's a pattern in the 35,000 ports. (ie something like address aggregation)
  • Is it possible to do eg 10 smaller matches and join them up?
  • Does tshark (or wireshark) have the same issues?
  • Can you do the task textually? (Ie, get tcpdump to print the packets out, do matching with awk/php/whatever)
  • Run a suitably large instance computer (eg at AWS) with monster amount of memory, for an hour
  • Write a small C program to do the work, as PCAP files are pretty easy to work with

I've normally found myself writing a small C program for large analyses, especially if they are things I'd need to do frequently and it's as simple as selecting on a big list of port numbers. My understanding is that the main pcap filtering compiles a big expression, which can be memory-hungry. Normally my programs are running on pretty small computers.

I've always coded from scratch following the documentation of the file format at Wireshark, rather than use the pcap library.

Improve this answer
1
  • thank you very much for your input, i think i will either go for splitting up the filter into smaller files or check how to do it with tshark (i did not prefer tshark before cause it takes double the time to complete it)
    – Anivos
    Apr 4, 2018 at 13:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.