Split pcap to multiple files based on number of packets

2019-06-03 1 min read Bash Learning Linux

Here is a script that can use tshark to split a large pcap to multiple small pcaps

 

inpcap="test.pcap"

max=$(tshark  -r $inpcap -n -T fields -e frame.number|tail -1)

# This is the number of packets in each split pcap
c=1

# Save all new pcaps to out, if it does not exist, create it.
[[ ! -d out ]] && mkdir out

for i in $(seq 1 $max $c)
do
        tshark  -r $inpcap  -n -c $c "frame.number==$i" -w out/$i.pcap
        #Do other stuff, if required
        read -p "Send the next packet? "
done

A very simple 3-4 line script that has saved my day so may times.

Continue reading

libvirt- Create virtual machine with text console only interface

2019-05-27 1 min read Linux Vurtualization

virt-install is an amazing tool to create VMs. If you have created a config file (Kickstart file – ks.cfg), then its only one line un-attended install. If you are using this on remote host with ssh and unluckily cannot export display – what do you do. Do a non-graphical install. There are only minor changes in the command to tell the installer that there is no graphics available and it is amazing, is it not 🙂

Continue reading

GREP_COLORS – change the colors in the GREP output.

2019-04-22 4 min read Bash Linux

Today we will look at the variable GREP_COLORS. This variable determines the colour that is used with the grep command. You can look at the man page of the grep command to see what the various options mean. Here is the excerpt from the man command:

GREP_COLORS
          Specifies the colors and other attributes used to highlight various  parts  of  the
          output.   Its  value  is  a  colon-separated  list of capabilities that defaults to
          ms=01;31:mc=01;31:sl=:cx=:fn=35:ln=32:bn=32:se=36  with  the  rv  and  ne   boolean
          capabilities omitted (i.e., false).  Supported capabilities are as follows.

          sl=    SGR  <a class="zem_slink" title="Substring" href="http://en.wikipedia.org/wiki/Substring" rel="wikipedia">substring</a>  for  whole  selected lines (i.e., matching lines when the -v
                 command-line option is omitted, or non-matching lines when -v is specified).
                 If however the boolean rv capability and the -v command-line option are both
                 specified, it applies to context matching lines  instead.   The  <a class="zem_slink" title="Default (finance)" href="http://en.wikipedia.org/wiki/Default_%28finance%29" rel="wikipedia">default</a>  is
                 empty (i.e., the terminal's default color pair).

          cx=    SGR  substring for whole context lines (i.e., non-matching lines when the -v
                 command-line option is omitted, or matching lines when -v is specified).  If
                 however  the  boolean  rv capability and the -v command-line option are both
                 specified, it applies to selected non-matching lines instead.   The  default
                 is empty (i.e., the terminal's default color pair).

          rv     <a class="zem_slink" title="Boolean data type" href="http://en.wikipedia.org/wiki/Boolean_data_type" rel="wikipedia">Boolean  value</a>  that  reverses  (swaps)  the  meanings  of  the  sl= and cx=
                 capabilities when the -v command-line option is specified.  The  default  is
                 false (i.e., the capability is omitted).

          mt=01;31
                 SGR  substring  for  matching  <a class="zem_slink" title="Empty set" href="http://en.wikipedia.org/wiki/Empty_set" rel="wikipedia">non-empty</a>  text in any matching line (i.e., a
                 selected line when the -v command-line option is omitted, or a context  line
                 when  -v  is specified).  Setting this is equivalent to setting both ms= and
                 mc= at once to the same value.  The default is a bold  red  text  foreground
                 over the current line background.

          ms=01;31
                 SGR substring for matching non-empty text in a selected line.  (This is only
                 used when the -v command-line option is omitted.)  The effect of the sl= (or
                 cx=  if  rv) capability remains active when this kicks in.  The default is a
                 bold red text foreground over the current line background.

          mc=01;31
                 SGR substring for matching non-empty text in a context line.  (This is  only
                 used  when  the -v command-line option is specified.)  The effect of the cx=
                 (or sl= if rv) capability remains active when this kicks in.  The default is
                 a bold red text foreground over the current line background.

          fn=35  SGR  substring  for file names prefixing any content line.  The default is a
                 magenta text foreground over the terminal's default background.

          ln=32  SGR substring for <a class="zem_slink" title="Line number" href="http://en.wikipedia.org/wiki/Line_number" rel="wikipedia">line numbers</a> prefixing any content line.  The default is a
                 green text foreground over the terminal's default background.

          bn=32  SGR substring for byte offsets prefixing any content line.  The default is a
                 green text foreground over the terminal's default background.

          se=36  SGR substring for separators that are inserted between selected line  fields
                 (:),  between context line fields, (-), and between groups of adjacent lines
                 when nonzero context  is  specified  (--).   The  default  is  a  cyan  text
                 foreground over the terminal's default background.

          ne     Boolean  value that prevents clearing to the <a class="zem_slink" title="Newline" href="http://en.wikipedia.org/wiki/Newline" rel="wikipedia">end of line</a> using Erase in Line
                 (EL) to Right (\33[K) each time a colorized item ends.  This  is  needed  on
                 terminals on which EL is not supported.  It is otherwise useful on terminals
                 for which the back_color_erase (bce) boolean terminfo  capability  does  not
                 apply,  when  the  chosen  highlight colors do not affect the background, or
                 when EL is too slow or causes too much flicker.  The default is false (i.e.,
                 the capability is omitted).

Continue reading
Older posts Newer posts