#!/bin/sh
#
# /usr/local/bin/capture [start | stop]
#
# by Woody A. Poolson 06Sep99
#
# captures live data across the network to a capture file named after
# the date and time.
#
# This script can stand alone or be used as part of the
# syslog/swatch/tripwire script for doing automated and unattended captures.
#
# The /usr/log/"capture files" was chosen so that a runaway capture would
# not "break" the /var partition. Found this out the hard way before...
#
# Set up variables below...
#
DUMP_FILE=/usr/log/`date "+%m%d.%H%M"`
CAPTURE_PID=/var/run/capture.pid
NIC=xl0
# the only choices are to start and stop.
# the argument is simply passed at the command line or within another
# script
#
case "$1" in
# the capture starts by doing the tcpdump and then "cooking" it for
# the headers in a nice layout of each packet.
#
# the next event clears the process ID file so that it is clean.
# finally, the PID is pulled from a ps and then redirected into the PID file.
#
start)
/usr/sbin/tcpdump -i $NIC -s 1518 -lenx | /usr/local/bin/tcpshow -cooked
> $DUMP_FILE &
cat /dev/null > $CAPTURE_PID
ps -ax | grep tcpdump | awk '{ print $1 }' > $CAPTURE_PID
;;
# to stop the capture that is started earlier, the pid file is read
# then killed. The sleep 1 second is to let things settle down before
# clearing the PID file.
stop)
kill `cat $CAPTURE_PID`
sleep 1
cat /dev/null > $CAPTURE_PID
;;
*)
echo "usage: $0 {start|stop}" 1>&2
exit
;;
esac