NAME

recs-fromtcpdump

recs-fromtcpdump --help-all

Usage: recs-fromtcpdump <file1> <file2> ...
   Runs tcpdump and puts out records, one for each packet. Expects pcap files.
   Will put the name of the originating capture file in the 'file' field.

   Will parse packet types: ethernet, ip, udp, arp, tcp The type key will
   indicate the highest level parsed. DNS information will be parsed for TCP or
   UDP packets that are from or to port 53. The parsed representation of the
   packet for each valid level will be placed in the corresponding key. For
   instance, for a tcp packet, there will be information in the keys 'ethernet',
   'ip', and 'tcp'

   By default, data output is suppressed due to poor interaction with
   terminal programs.

   Flags will be parsed into hash of strings
   Possible IP flags: congestion, dont_fragment, more_fragments
   Poassible TCP flags: ACK, CWR, ECE, FIN, PSH, RST, SYN, URG

   ARP opcodes will be matched
   Possible opcodes: ARP_REPLY, ARP_REQUEST, RARP_REPLY, RARP_REQUEST

Creating a pcap file:
   Run a tcpdump command with -w FILE to produce a pcap file. For instance: sudo
   tcpdump -w /var/tmp/capture.pcap

   Optionally, include all the data and timing information: sudo tcpdump -w
   capture.pcap -s4096 -S -tt

   See 'man tcpdump' for more information.

Arguments
   --data                       Include raw data bytes of deepest packet level
   --filename-key|fk <keyspec>  Add a key with the source filename (if no
                                filename is applicable will put NONE)

  Help Options:
      --help  This help screen

Examples
   Get records for all packets
      recs-fromtcpdump  capture.pcap

SEE ALSO

• See App::RecordStream for an overview of the scripts and the system

• Run recs examples or see App::RecordStream::Manual::Examples for a set of simple recs examples

• Run recs story or see App::RecordStream::Manual::Story for a humorous introduction to RecordStream

• Every command has a --help mode available to print out usage and examples for the particular command, just like the output above.