Re: searching pcap file
Re: searching pcap file
- Subject: Re: searching pcap file
- From: Scott Ribe <email@hidden>
- Date: Thu, 03 Sep 2015 07:53:41 -0600
- Authentication-results: symauth.service.identifier
On Sep 3, 2015, at 2:34 AM, Quinn The Eskimo! <email@hidden> wrote:
>
> On 2 Sep 2015, at 17:05, Scott Ribe <email@hidden> wrote:
>
>> What tool could I use to perform the following kind of search:
>>
>> for a particular machine, find all instances where any other machine sent a packet, and received a response more than x seconds later
>
> Are we talking HTTP here?
No, custom protocol, binary, compressed. I have no interest in the contents of packets.
Just need to trace out by sequence #, so I can compare instances of long delays between tcpdump on client, packet capture immediately in front of server, and logs from firewall.
--
Scott Ribe
email@hidden
http://www.elevated-dev.com/
https://www.linkedin.com/in/scottribe/
(303) 722-0567 voice
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Macnetworkprog mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden