Thanks, for your replay...
Kiran
On Sun, 4 Feb 2001, Guy Harris wrote:
> On Sun, Feb 04, 2001 at 11:35:24PM +0530, Kiran Kumar M wrote:
> > I want to run tcpdump for 1 min. of time and then I want analyse the
> > packets. How can I do that. I want to stop it automatically.... just like
> > after (with -c option) getting the required packets.
>
> You can't do it completely automatically. Tcpdump has no mechanism for
> doing "timed" captures of that sort by itself.
>
> You would have to run both tcpdump and then a command line that does
> something such as
>
> sleep 60; kill <pid>
>
> where <pid> is the process ID of the tcpdump process. This could
> probably be done with a shell script.
>
> > Is there any tool that will explain the detail description of the packets
> > that are captured with -x or -X option.
>
> "-x" and "-X" aren't capture options, they're display options. For a
> description of at least some of the details of packet contents as dumped
> by those options, see
>
> http://www.rfc-editor.org/
>
> I.e., all "-x" and "-X" do is give you a hex and, with "-X", ASCII dump
> of the raw contents of the packet:
>
> -x Print each packet (minus its link level header) in
> hex. The smaller of the entire packet or snaplen
> bytes will be printed.
>
> -X When printing hex, print ascii too. Thus if -x is
> also set, the packet is printed in hex/ascii. This
> is very handy for analysing new protocols. Even if
> -x is not also set, some parts of some packets may
> be printed in hex/ascii.
>
> A description of the raw hex data is just a description of the protocols
> in question, so you'd have to read the RFCs (see the URL above) or other
> specifications (see, for example
>
> http://www.ietf.org/ID.html
>
> for Internet-Drafts) for the protocols.
> -
> This is the TCPDUMP workers list. It is archived at
> http://www.tcpdump.org/lists/workers/index.html
> To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
>
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
