Capture source & destination but not actaul packers 1

[edpatterson]

I am looking for either an ethereal filter string or another application that will allow me to log source and destination addresses without capturing the actual packets.

Thanks,
Ed

 

[LawnBoy]

There may be a way to do this with Ethereal (WireShark), but I'm not clever enough to see it...

Are you using managed switches? What can you get from them via SNMP?

 

[pansophic]

You have to set the Snap Length to 68 for IPv4 or 96 for IPv6 to capture only the packet header.

http://wiki.wireshark.org/SnapLen

pansophic

 

[LawnBoy]

Yes, that will limit the capture size, but does that mean you're only saving the header?

 

[edpatterson]

Thanks, I am using Cisco 3500XL switches and am not currently configured for SNMP traps. We are experiencing heavy inbound traffic and I want to see just how much of it is from streaming audio/video sites.

I do not have access to the router...

Ed

 

[pansophic]

Yes, if you look at the capture, you only get 68 bytes from each packet. Perfect for performance analysis.


pansophic