tcpdump_to_db - Man Page

convert tcpdump textual output to fsdb

Synopsis

    tcpdump_to_db [-T] < source.tcpdump > target.fsdb

Description

Converts a tcpdump textual data stream to Fsdb format.

However, irregularity in the tcpdump format makes it very difficult to parse. Rather than using tcpdump, a better choice is use tshark(1) with the -e fields option, then use dbcoldefine to give the columns names.

But tcpdump's text output format is not recommended for programmatic use. It has too many irregularities to be reliable. For example, most UDP is labeled UDP, but DNS and SIP is extracted and not easily distinguishable.

It handles timestamps in default format (h:m:s.d since start) and -tt format (s.d epoch seconds).

By default src and dest are tcpdump-style with a .port at the end. Use --ports to split into src_ip src_port dest_ip dest_port.

Options

-t or --daytime

Adjust times relative to the first timestamp. (Defaults on.)

--ports

Split ports out, generating four fields: src_ip src_port dest_ip dest_port. (Default is two fields, src dest with ports appended after a period.)

(Defaults on.)

This module also supports the standard fsdb options:

-d

Enable debugging output.

-i or --input InputSource

Read from InputSource, typically a file name, or - for standard input, or (if in Perl) a IO::Handle, Fsdb::IO or Fsdb::BoundedQueue objects.

-o or --output OutputDestination

Write to OutputDestination, typically a file name, or - for standard output, or (if in Perl) a IO::Handle, Fsdb::IO or Fsdb::BoundedQueue objects.

--autorun or --noautorun

By default, programs process automatically, but Fsdb::Filter objects in Perl do not run until you invoke the run() method. The --(no)autorun option controls that behavior within Perl.

--help

Show help.

--man

Show full manual.

Sample Usage

Input

    14:11:12.556781 dash.isi.edu.1023 > excalibur.usc.edu.ssh: S 2306448962:2306448962(0) win 32120 <mss 1460,sackOK,timestamp 82802652[|tcp]> (DF)
    14:11:12.561734 excalibur.usc.edu.ssh > dash.isi.edu.1023: S 1968320001:1968320001(0) ack 2306448963 win 4096
    14:11:12.561875 dash.isi.edu.1023 > excalibur.usc.edu.ssh: . ack 1 win 32120 (DF)
    14:11:18.746567 excalibur.usc.edu.ssh > dash.isi.edu.1023: P 316:328(12) ack 348 win 4096
    14:11:18.755176 dash.isi.edu.1023 > excalibur.usc.edu.ssh: P 348:488(140) ack 328 win 32696 (DF) [tos 0x10]
    14:11:18.847937 excalibur.usc.edu.ssh > dash.isi.edu.1023: P 328:468(140) ack 488 win 4096
    14:11:18.860047 dash.isi.edu.1023 > excalibur.usc.edu.ssh: . ack 468 win 32696 (DF) [tos 0x10]
    14:11:18.936255 dash.isi.edu.1023 > excalibur.usc.edu.ssh: P 488:516(28) ack 468 win 32696 (DF) [tos 0x10]

or a more modern form

    17:00:14.808855 IP 10.0.0.172.31738 > 10.1.0.50.telnet: Flags [S], seq 3236187954, win 21463, length 0

and

    15:29:11.162365 IP6 2001:1878:404:f200::76d.41392 > 2001:1878:401::8009:1c09.https: Flags [S], seq 485329338, win 64660, options [mss 1220,sackOK,TS val 3349932199 ecr 0,nop,wscale 10], length 0

Command

    tcpdump_to_db

Output

    #fsdb time proto src dest flags start end len ack win
    51072.556781 tcp dash.isi.edu.1023 excalibur.usc.edu.ssh S 2306448962 2306448962 0 - 32120
    51072.561734 tcp excalibur.usc.edu.ssh dash.isi.edu.1023 S 1968320001 1968320001 0 2306448963 4096
    51072.561875 tcp dash.isi.edu.1023 excalibur.usc.edu.ssh . - - - 1 32120
    51078.746567 tcp excalibur.usc.edu.ssh dash.isi.edu.1023 P 316 328 12 348 4096
    51078.755176 tcp dash.isi.edu.1023 excalibur.usc.edu.ssh P 348 488 140 328 32696
    51078.847937 tcp excalibur.usc.edu.ssh dash.isi.edu.1023 P 328 468 140 488 4096
    51078.860047 tcp dash.isi.edu.1023 excalibur.usc.edu.ssh . - - - 468 32696
    51078.936255 tcp dash.isi.edu.1023 excalibur.usc.edu.ssh P 488 516 28 468 32696
    #  | tcpdump_to_db

See Also

Fsdb.

Info

2026-06-08 perl v5.42.2 User Contributed Perl Documentation