Fsdb::F...mp_to_db(3)

💅 Fsdb::F...mp_to_db(3) 💅

okay so this is a User Contributed Perl Documentation page for Fsdb::F...mp_to_db(3) — the tcpdump_to_db filter, and it's lowkey iconic. Let's get into it, bestie. 🫶

✨ NAME ✨

tcpdump_to_db — convert tcpdump textual output to fsdb

💅 SYNOPSIS 💅

tcpdump_to_db [-T] < source.tcpdump > target.fsdb

🦋 DESCRIPTION 🦋

It converts a textual tcpdump data stream into Fsdb format. Simple as that. 💖

⚠️ Important caveat, bestie: currently it handles only TCP and silently fails on other traffic! Awaiting enhancement... you're welcome to help. 🫶

🎀 OPTIONS 🎀

• -t or --daytime — adjust times relative to the first timestamp. (Defaults on.) ⏰
• -d — enable debugging output.
• -i or --input InputSource — read from InputSource, typically a file name, or "-" for standard input, or (if in Perl) a IO::Handle, Fsdb::IO or Fsdb::BoundedQueue objects.
• -o or --output OutputDestination — write to OutputDestination, typically a file name, or "-" for standard output, or (if in Perl) a IO::Handle, Fsdb::IO or Fsdb::BoundedQueue objects.
• --autorun or --noautorun — by default, programs process automatically, but Fsdb::Filter objects in Perl do not run until you invoke the run() method. The --(no)autorun option controls that behavior within Perl.
• --help — show help.
• --man — show full manual.

This module also supports the standard fsdb options, bestie. 🫶

🌸 SAMPLE USAGE 🌸

Input

14:11:12.556781 dash.isi.edu.1023 > excalibur.usc.edu.ssh: S 2306448962:2306448962(0) win 32120 <mss 1460,sackOK,timestamp 82802652[|tcp]> (DF)
14:11:12.561734 excalibur.usc.edu.ssh > dash.isi.edu.1023: S 1968320001:1968320001(0) ack 2306448963 win 4096
14:11:12.561875 dash.isi.edu.1023 > excalibur.usc.edu.ssh: . ack 1 win 32120 (DF)
14:11:18.746567 excalibur.usc.edu.ssh > dash.isi.edu.1023: P 316:328(12) ack 348 win 4096
14:11:18.755176 dash.isi.edu.1023 > excalibur.usc.edu.ssh: P 348:488(140) ack 328 win 32696 (DF) [tos 0x10]
14:11:18.847937 excalibur.usc.edu.ssh > dash.isi.edu.1023: P 328:468(140) ack 488 win 4096
14:11:18.860047 dash.isi.edu.1023 > excalibur.usc.edu.ssh: . ack 468 win 32696 (DF) [tos 0x10]
14:11:18.936255 dash.isi.edu.1023 > excalibur.usc.edu.ssh: P 488:516(28) ack 468 win 32696 (DF) [tos 0x10]

or a more modern form

17:00:14.808855 IP 10.0.0.172.31738 > 10.1.0.50.telnet: Flags [S], seq 3236187954, win 21463, length 0

Command

tcpdump_to_db

Output

#fsdb time proto src dest flags start end len ack win
51072.556781 tcp dash.isi.edu.1023 excalibur.usc.edu.ssh S 2306448962 2306448962 0 - 32120
51072.561734 tcp excalibur.usc.edu.ssh dash.isi.edu.1023 S 1968320001 1968320001 0 2306448963 4096
51072.561875 tcp dash.isi.edu.1023 excalibur.usc.edu.ssh . - - - 1 32120
51078.746567 tcp excalibur.usc.edu.ssh dash.isi.edu.1023 P 316 328 12 348 4096
51078.755176 tcp dash.isi.edu.1023 excalibur.usc.edu.ssh P 348 488 140 328 32696
51078.847937 tcp excalibur.usc.edu.ssh dash.isi.edu.1023 P 328 468 140 488 4096
51078.860047 tcp dash.isi.edu.1023 excalibur.usc.edu.ssh . - - - 468 32696
51078.936255 tcp dash.isi.edu.1023 excalibur.usc.edu.ssh P 488 516 28 468 32696
#  | tcpdump_to_db

🔥 SEE ALSO 🔥

Fsdb.

🧚 CLASS FUNCTIONS 🧚

new

$filter = new Fsdb::Filter::tcpdump_to_db(@arguments);

Create a new tcpdump_to_db object, taking command-line arguments. 🎀

set_defaults

$filter->set_defaults();

Internal: set up defaults.

parse_options

$filter->parse_options(@ARGV);

Internal: parse command-line arguments.

setup

$filter->setup();

Internal: setup, parse headers.

_conv_time

$daytime = $self->_conv_time($raw);

Convert tcpdump h:mm:ss.SS format to absolute seconds. ⏱️

run

$filter->run();

Internal: run over each row.

👑 AUTHOR and COPYRIGHT 👑

Copyright (C) 1991-2018 by John Heidemann <johnh@isi.edu>

This program is distributed under terms of the GNU general public license, version 2. See the file COPYING with the distribution for details.

---

💖 and that's a wrap, bestie! This page came from perl v5.32.1, dated 2024-08-02, under Fsdb::F...mp_to_db(3). Stay slaying those packets! 🎀