Using snoop/tcpdump as a Filter
Okay, this is kinda cool. Yesterday, I ran snoop (Sun’s version of tcpdump) to help the network folks diagnose a problem we’ve been seeing. Unfortunately, I let it run a bit too long, and wound up with a 1.5Gb file. And the guy who’s going to be looking at this is at a conference, and would rather not download files that big.
Now, I’d known that snoop can dump packets to a file with -o filename and that that file can be read with -i filename; and of course that you can give an expression to say what kinds of packets you want to scan for. But until now, it never occurred to me to put the three of them together. And it turns out that not only does snoop support that, it Does The Right Thing to boot.
Now, one of the reasons I wound up with 1.5Gb worth of packets is that we didn’t know which port the process we were trying to debug would run on, until it ran. (That, and the fact that I started scanning early because I wasn’t sure when it would run. And ending late because the Internet dangled shiny things in front of me.)
At any rate, I was able to run
# snoop -i old-snoop-log -o new-snoop-log host thehost.dom.ain port 50175
and wind up with a packet capture file of manageable size.
And a bit of experimentation showed that tcpdump does the same thing (adjust arguments as appropriate). I’ll have to remember this.
Ramp Closed. Use Next Exit
(See what I did there? It’s because my site is a fill-in-the-blank on the Information Superhighway. Get it?)
The more eagle-eyed among you who visit this site on a regular basis (both of you) may have noticed some changes to the layout and whatnot. Or maybe something just went kerflooie in the RSS feed and your aggregator has just tossed the whole thing in the trash rather than try to deal with it.
Well, not that you asked (you could’ve asked, you know. I take an interest in your lives, you insensitive assholes1), but I’ve been messing with things behind the scenes, mainly to avoid having to update stuff all the time. So, in keeping with the vintage 1992 metaphor in the title, I’ve stopped leaning on my shovel, drained the last of my coffee, and actually gotten to work fixing the actual roadway underneath the twenty-times-patched potholes. And then knocking off early and asking someone to punch my time clock for me, because that’s the kind of tireless lazy fucker I am.
Actually, one thing y’all might like is the “Reply” button underneath comments, that allow you to reply to individual comments.
And now, if you’ll excuse me, I need to pop over to Geocities to download some animated “Under Construction” and flashing-light GIFs.
1: Not intended as a factual statement.