Real-Time Analysis

Real-Time analysis can be done trivially by piping the output of the packet capture program, and letting tcptrace fetch its input from stdin. With tcpdump, it can be done as in :

tcpdump -w - | tcptrace stdin

This would let tcptrace read the input from the binary output generated by tcpdump, until the process is interrupted with say Ctrl C, for example. However, this is not really real-time in the sense that the output is generated only after the process is interrupted, which is analogous to tcptrace printing output at the end of processing a dumpfile.

The option --continuous lets tcptrace run continuously and provides no summary of connections at the end. This option is normally useful when used along with modules and maintains a list of active connections.

The following options can be used along with the --continuous option :


Super-User 2003-08-29