Brian
> Question:
> Can Ethereal open multiple files at once or at least
> search multiple files for a filtered item??
> EX: I have 400 snoop files from a monitored session
> waiting for an outage and the outage occurred so I edd
> to look into 400 files for a few specific addresses
> and opening 400 one a time and searching is real
> annoying. Is there anyway for ethereal to scan a list
> of diles and display matching queries??
Here's how I would do this on Windows. I'm sure the same sort of thing
will work with a shell script.
- Put all of your trace files in a directory by themselves
- Make a subdirectory called filtered
- From your trace directory run the following. (It should be all on one
line, I've just spaced it so that it's readable):
for %1 in (*.*) do tethereal
-r %1
-w filtered\%1
-R "ip.addr == 1.2.3.4"
This will cause tethereal to read each file "%1" and write a new trace
in the filtered directory with the same name. -R specifies the display
filter you require.
When finished, any files in filtered with more than a trivial size will
contain the frames you are interested in. You might want to use
mergecap to join this filtered files into a single trace when you're
done.
HTH
Alistair
-----------------------------------------------------------------------
Registered Office:
Marks & Spencer p.l.c
Michael House, Baker Street,
London, W1U 8EP
Registered No. 214436 in England and Wales.
Telephone (020) 7935 4422
Facsimile (020) 7487 2670
www.marksandspencer.com
Please note that electronic mail may be monitored.
This e-mail is confidential. If you received it by mistake, please let us know and then delete it from your system; you should not copy, disclose, or distribute its contents to anyone nor act in reliance on this e-mail, as this is prohibited and may be unlawful.
The registered office of Marks and Spencer Financial Services PLC, Marks and Spencer Unit Trust Management Limited, Marks and Spencer Life Assurance Limited and Marks and Spencer Savings and Investments Limited is Kings Meadow, Chester, CH99 9FB. These firms are authorised and regulated by the Financial Services Authority.