tcpdump - how to filter based on tcp connection time / duration [closed]

Question

Is there a possibility to filter tcpdump (live or after creating a dump) based on tcp connection time (connection duration)?

I'm recording http json rpc traffic. I want to record only connections that are longer than lets say 1000 ms.

In wireshark there is tool in Menu->Statistics->Conversations (TCP tab) and there i can sort by "Duration". But i want to record (or filter) long lived connections before (not in wireshark).

In pseudo commands I want to do something like this:

tcpdump -i eth0 port 80 and connectionTime>1000ms -w data.pcap

or after recording:

cat data.pcap | SOMETOOL -connectionTime>1000ms > dataLongConnections.pcap

SOMETOOL must export filtered data to format that Wireshark will understand. Because after filtering I want to analyze that data in Wireshark.

How I can do this?

Answer 1

SplitCap might work for you. It will take PCAP as an input and output separate PCAPs for each TCP/UDP session. After the split you could filter from the output PCAPs the interesting ones to keep.

Answer 2

You need to consider your traffic at flow level instead of packet level.

If you worked with NetFlow you could use flow-tools and flow-nfilter to filter flows by duration. So you could convert your pcap to NetFlow and later filter it.

The drawback is that at the output you get NetFlow, not PCAP. For building some stats it is sufficient, but to check packets - not certainly.

You can also build your own tool with libpcap in C (hard way) or scapy in python (easier way). The latter option shouldn't be too difficult (provided you work with python)