Sending data from tcpdump with grep to a text file for later analysis

This article applies to:

• SIEM OE 5.x (DA)
• SIEM LP

Question:

• I'm using tcpdump and grep to check on data flow into my SIEM system
• There is too much data and it scrolls too quickly. How can I save the data so that I can review and analyze it later?

Procedure:

To save the output of a command for later viewing, you can send the results straight to a text file using the standard out operator ">" (or ">>", see the note below).

Next, experiment with tcpdump and grep to filter the data you need.

Once you have worked out the appropriate commands and filters in place, run the command and use "> /{directory}/{text file name}" to send the results to a text file.

Your command should look something like this:

The below screenshot shows how to check a portion of the text file for the output (you may want to navigate back to the root directory / in order to simplify entering the file name):

Note:

Once the original file has been created, using ">" to send more data to the same file will overwrite the data that already exists.

To append data, use the ">>" operator instead.