netsniff-ng problem

[Li Tianmei-BPF364]

Hi ,

 

I downloaded and installed the following netsniff-ng, then used it to capture packets.

But I found the packet size was very small(like 8 or 9M),  and “many packets failed filter(due to out of space)”, while other tools(such as tcpdump, wireshark) had no such problem.

 

So I wonder why this problem occurred, could you please help me out? Thanks.

 

 

 

BR,

Li Tianmei

 

[Daniel Borkmann]

On 05/22/2013 04:46 AM, Li Tianmei-BPF364 wrote:
> Hi ,
>
> I downloaded and installed the following netsniff-ng, then used it to capture packets.
> But I found the packet size was very small(like 8 or 9M), and "many packets failed filter(due to out of space)", while other tools(such as tcpdump, wireshark) had no such problem.

Could you elaborate on that?

I assume instead of packet size you rather mean pcap file size, right?

What command did you use to capture packets?

What kind of packets do you expect to capture? All or only packets of particular type?

Cheers,

Daniel

[Li Tianmei-BPF364]

Hi,

The following is the command I used, I expect to capture all packets. Thanks.

# netsniff-ng -p netsniff.pcap --silent

Receive ring dumping ... |
Got SIGINT here!
681347 frames incoming
52234 frames passed filter
629113 frames failed filter (due to out of space)




BR,
Li Tianmei

[Daniel Borkmann]

On 05/22/2013 10:18 AM, Li Tianmei-BPF364 wrote:
> Hi,
>
> The following is the command I used, I expect to capture all packets. Thanks.
>
> # netsniff-ng -p netsniff.pcap --silent

Ohm, there's no such thing as -p. If not already done, get, build and install the
latest version of netsniff-ng:

git clone git://github.com/borkmann/netsniff-ng.git

There's an INSTALL document with further information.

Then, try to use this:

netsniff-ng -i eth0 -o foo.pcap -b0 -s

where eth0 is obvisouly your networking device and foo.pcap the pcap file you
store the stuff in. In case you do not want to store everything, use BPF filters.

All described in the man pages in sufficient detail.

Hope this helps.

Cheers,

Daniel