Tcpdump file size == traffic size

packet-sniffersniffingtcpdump

I created a tcpdump file:

tcpdump -i eth0 host xxx.208.xxx.59 -n -s 0 -vvv -w /tmp/dump.dmp

duration was about 3 hours.

This file now has 450 MB. Can I say now that the IP xxx.208.xxx.59 generated 450 MB traffic in 3 hours?

Best Answer

Yes, maybe, not necessarily.

A pcap file is not simply a byte-for-byte representation of the traffic that was sent/received. Things that will contribute to inaccuracies include:

pcap file overhead. Every packet is timestamped, for instance.
Impedance mismatch between pcap's idea of a "packet" and your understanding of what constitutes a "packet". The pcap file will have everything including the link-layer header, which is rarely considered part of a customer's traffic allowance for billing purposes.
Missing packets. The pcap layer makes no assurances that all packets will actually be transferred into tcpdump's gentle care. Many packets may have been dropped (for a variety of reasons), and they won't be a part of the count you see.

If you want to account for traffic, do it properly, with port or netflow statistics retrieved from your core.

Related Solutions

Monitoring HTTP traffic using tcpdump

tcpdump prints complete packets. "Garbage" you see are actually TCP package headers.

you can certainly massage the output with i.e. a perl script, but why not use tshark, the textual version of wireshark instead?

tshark 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'

it takes the same arguments as tcpdump (same library) but since its an analyzer it can do deep packet inspection so you can refine your filters even more, i.e.

tshark 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' -R'http.request.method == "GET" || http.request.method == "HEAD"'

PCAP – How to Split a PCAP File into Smaller Files

You can use tcpdump itself with the -C, -r and -w options

tcpdump -r old_file -w new_files -C 10

The "-C" option specifies the size of the file to split into. Eg: In the above case new files size will be 10 million bytes each.

Best Answer

Related Solutions

Monitoring HTTP traffic using tcpdump

PCAP – How to Split a PCAP File into Smaller Files

Related Topic