Split pcap to multiple files based on number of packets

Here is a script that can use tshark to split a large pcap to multiple small pcaps

inpcap="test.pcap"

max=$(tshark  -r $inpcap -n -T fields -e frame.number|tail -1)

# This is the number of packets in each split pcap
c=1

# Save all new pcaps to out, if it does not exist, create it.
[[ ! -d out ]] && mkdir out

for i in $(seq 1 $max $c)
do
        tshark  -r $inpcap  -n -c $c "frame.number==$i" -w out/$i.pcap
        #Do other stuff, if required
        read -p "Send the next packet? "
done

A very simple 3-4 line script that has saved my day so may times.

dnstop – top like utility for Fedora and other *nix

For installation :

sudo yum install dnstop

And now some description:

dnstop is a libpcap application (ala tcpdump) that displays various
tables of DNS traffic on your network.

dnstop supports both IPv4 and IPv6 addresses.

To help find especially undesirable DNS queries, dnstop provides a
number of filters.

dnstop can either read packets from the live capture device, or from a
tcpdump savefile.

Couple of days back, I realized there was too much network activity on my
system, although I was not doing anything. Fired up wireshark and to my
astonishment, there was too much of DNS traffic on the network. But the
problem was analyzing the data in wireshark and this is where dnstop came
into light. It helped me narrow down the issue within minutes and problems
resolved.