Tcpdump is amazing

Re:Tcpdump is amazing by pjc50 on Thursday March 17, 2016 @05:39AM (#11303386)

Wireshark is great, but it's fundamentally an interactive tool; you fire it up when you have a problem to look into and close it down afterwards. Running wireshark/tcpdump all the time seems like it would generate too much data. I'm not sure how well Wireshark handles dumps larger than available RAM, either.

The author mentions the pcap filter language, but one of the misfeatures of Wireshark is that it has a different filter language for the GUI filter box.

[ Parent | on HN ]

Re:Tcpdump is amazing by AjithAntony on Thursday March 17, 2016 @06:43AM (#11303576)

The capture filters and display filters are interfaces to two sort of unrelated pieces. Maybe the misfeature is that wireshark doesn't do good job of communicating that.

BTW, If you want constant monitoring for your applications, you can buy a shark appliance that you can always go back to to investigate issues.

[ Parent | on HN ]

Re:Tcpdump is amazing by tdriggs on Thursday March 17, 2016 @06:13PM (#11308049)

There are commercial products that you can leave running all the time to generate data from your packets on the fly, such as ExtraHop (http://extrahop.com). There are also continuous PCAP tools, but they need massive amounts of storage and in larger environments the lookback you get is limited.

[ Parent | on HN ]

Re:Tcpdump is amazing by dkopi on Thursday March 17, 2016 @06:24AM (#11303533)

Capture filters not being similar to GUI filters have always been the #1 issue I've had with Wireshark.

[ Parent | on HN ]