I want to capture concurrently and save it as multiple files where each file has its own distinct capture filter?
Hello,
I am capturing all traffic from an ethernet interface. I want to capture concurrently and save it as multiple files where each file has its own distinct capture filter? For example one pcap file per each source IP address. What are the performance and memory implications? My throughput is 1Gb/s and in some examples, it can be up to 5 Gb/s.
I am looking for a Tshark command and it will be unmanned operation
What are you actually trying to do here? If you want a record of all traffic to look at later and have sufficient storage space, you can take one large capture. If you are looking for a specific problem, then you use the relevant capture filter to decrease the file size.
You would have to run a tshark process per capture filter. Not sure how feasible that would be.
@Anders - I agree that this is the general solution, it sounds like he wants to a pcap created dynamically for each IP address? This would not be something that you could specify in a capture filter. I feel that if P Rao would explain his use case, we will be able to better help him (correct me if I'm missing something).