pcap question
I have a 76 MB tcpdump capture file.
Any way I can easily dump the first 100-200k of each TCP connection as a text file into a directory? And showing both directions as ethereal's "Follow TCP stream" does, though I don't need color coding.
I just want to run a (large) regexp against all the flows and pick out certain ones.
Surely this has been done before, so what should I use?
Any way I can easily dump the first 100-200k of each TCP connection as a text file into a directory? And showing both directions as ethereal's "Follow TCP stream" does, though I don't need color coding.
I just want to run a (large) regexp against all the flows and pick out certain ones.
Surely this has been done before, so what should I use?