Split pcap to multiple files based on number of packets

2019-06-03 1 min read Bash Learning Linux

Here is a script that can use tshark to split a large pcap to multiple small pcaps

 

inpcap="test.pcap"

max=$(tshark  -r $inpcap -n -T fields -e frame.number|tail -1)

# This is the number of packets in each split pcap
c=1

# Save all new pcaps to out, if it does not exist, create it.
[[ ! -d out ]] && mkdir out

for i in $(seq 1 $max $c)
do
        tshark  -r $inpcap  -n -c $c "frame.number==$i" -w out/$i.pcap
        #Do other stuff, if required
        read -p "Send the next packet? "
done

A very simple 3-4 line script that has saved my day so may times.

Continue reading

copy /proc folder

2019-03-18 1 min read Bash Learning Linux

Other day, I was trying to copy the proc folder with following command:

tar cvzf /tmp/proc.tgz /proc

and I found out that all the files in tar were empty. Strange it may seem but lot of people are facing this as /proc is not a regular filesystem, so I wrote a quick script to copy the proc folder. Here is the script:

cd /
mkdir /tmp/proc
[[ -z $1 ]] && exit -1
find /proc/$1/ -not -name pagemap | while read F ; do
    D=/tmp/$F
    if [[ -d $F ]]
    then
        echo "$(ls -ld $F) => Directory"
        mkdir -p $D
    fi
    if [[ -L $F ]]
    then
        echo "$(ls -ld $F) => copied"
        cp -P $F /tmp/$F
        
    elif [[ -f $F ]]
    then
        echo "$(ls -ld $F) => Cat"
        cat $F > /tmp/$F
    else
        echo "Dont know $F"
    fi
done

cool sed/grep magic to convert output to csv format

2019-03-11 1 min read Bash Learning

I generallly keep doing this a lot, so thought will share with you. Lets assume we are capturing free ouput every min/hour/or whatever. The output looks like this:

Time: Mon Jan 21 23:59:10 AEDT 2019
——————-

total        used        free      shared  buff/cache   available
Mem:          32014        8656        1735        1697       21621       21308
Swap: 51195 75 51120

then we can use some grep and sed to convert this to something like this:

Mon Jan 21 23:59:10 AEDT 2019,32014,8656,1735,1697,21621,21308

Continue reading
Older posts Newer posts