[sclug] Monitoring a P2P appliacation

[lug at assursys.co.uk]

On Wed, 18 Jun 2003, Patrick Kirk wrote:

> So, does anyone know how I can write a filter file that captures all 
> data of tcp port 6346 to 192.168.0.5 and outputs it to a file called 
> phasar.log which will be no larger than 50MB.


# tethereal -a filesize:50000 -f "host 192.168.0.5 and port 6346" -w phasar.log

tethereal uses 1000byte blocks for the filesize comparison, so you may need
to fiddle with the 50000 value if having precisely <=50MB is important to
you.

Best Regards,
Alex.
-- 
Alex Butcher      Brainbench MVP for Internet Security: www.brainbench.com
Bristol, UK                      Need reliable and secure network systems?
PGP/GnuPG ID:0x271fd950                         <http://www.assursys.com/>