我有一个bash脚本,我把它放在一起,根据一个公共过滤器合并多个数据包捕获。我正在后台运行守护进程记录器,它根据大小滚动pcap,所以有时很难获得整个图片,因为我正在寻找的数据可能在一个pcap中,其余的数据可能在另一个pcap中。我最大的不满是无法加快这一进程。它一次只能处理一个pcap。有人对如何使用多个子进程或多个线程来加快速度有任何建议吗?
#!/bin/bash
echo '[+] example tcp dump filters:'
echo '[+] host 1.1.1.1'
echo '[+] host 1.1.1.1 dst port 80'
echo '[+] host 1.1.1.1 and host 2.2.2.2 and dst port 80'
echo 'tcpdump filter:'
read FILTER
cd /var/mycaps/
DATESTAMP=$(date +"%m-%d-%Y-%H:%M")
# make a specific folder to drop the filtered pcaps in
mkdir /var/mycaps/temp/$DATESTAMP
# iterate over all pcaps and check for an instance of your filter
for file in $(ls *.pcap); do
tcpdump -nn -A -w temp/$DATESTAMP/$file -r $file $FILTER
# remove empty pcaps that dont match
if [ "`ls -l temp/$DATESTAMP/$file | awk '{print $5}'`" = "24" ]; then
rm -f "temp/$DATESTAMP/$file"
fi
done
echo '[+] Merging pcaps'
# cd to your pcap directory
cd /var/mycaps/temp/${DATESTAMP}
# merge all of the pcaps into one file and remove the seperated files
mergecap *.pcap -w merged.pcap
rm -f original.*
echo "[+] Done. your files are in $(pwd)"发布于 2016-02-02 19:45:39
在后台运行循环主体,然后等待所有后台作业完成后再继续。
max_jobs=10 # For example
job_count=0
for file in *.pcap; do # Don't iterate over the output of ls
(tcpdump -nn -A -w temp/"$DATESTAMP"/"$file" -r "$file" $FILTER
# remove empty pcaps that don't match. Use stat to get the file size
if [ "$(stat -c "%s")" = 24 ]; then
rm -f "temp/$DATESTAMP/$file"
fi
) &
job_count=$((job_count+1))
if [ "$job_count" -gt "$max_jobs" ]; then
wait
job_count=0
fi
done
waithttps://stackoverflow.com/questions/35161419
复制相似问题