Ethereal-users: [Ethereal-users] is it possible to do this all in one pass?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "George P Nychis" <gnychis@xxxxxxx>
Date: Fri, 17 Mar 2006 22:01:57 -0500 (EST)
Hey,

I am using a bash script, which reads the very first packet time and very last packet time from Luis's perl script.  I think break the file up into five minute intervals by real clock time using editcap -A <start> -B <finish> ...

However, I also want to only take packets with TCP destination port 80, and it seems as though editcap can't filter packets like tethereal can...or can it and i'm just missing it?

If not I may have to do this in two passes... editcap to filter the times, then tethereal to filter the TCP dest port 80... or visa versa.

Thanks!
George