Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

My understanding is that you want to:

  1. Capture with minimal risk of dropped packets
  2. Create one pcap file per unique IP address
  3. Do this really fast without using much CPU or memory

My recommendation would be this:

  1. Sniff with something fast, like netsniff-ng, and put all packets in one big pcap file. Tcpdump or dumpcap are okay too.
  2. Use SplitCap to split the big pcap file based on IP addresses like this: SplitCap.exe -r dump.pcap -s host

You will now have a bunch of PCAP files, one for each observed unique IP address.