Question

I have tcpdump like this

sudo tcpdmp tcp -n -i eth0 -w test.dmp

I want to calculate the number of tcp bytes going through eth0. I capture all the package using tcpdump as above. Is the file size equal the number of bytes or tcpdump add additional information into the dump file?

Answer 1

Yes, tcpdump adds additional information to the file.

It (currently) writes only in pcap format, which means there’s a 24-byte header at the beginning of the file, giving information such as the link-layer header type for packets in the file, so the first thing you’d need to do would be to subtract 24 from the size of the file.

In addition, each packet has a 16-byte header giving an arrival time stamp for the packet, the length of the packet, and the number of bytes of packet data that was captured. This means that you would need to subtract 16*{number of packets} from the length – but the only way to get the number of packets is to read the file, so you can’t get the number of bytes just by looking at the file size!

Note also that some versions of tcpdump did not default to a “snapshot length” of 0, so the number of bytes of packet data that is captured may be less than the number of packet bytes on the network.

Therefore, what you should do is write a program (use libpcap, as it already knows pcap format and you don’t have to write your own code to understand it) that reads all the packets and adds up the “length of the packet” field (it’s the len field in the struct pcap_pkthdr structure; do not use caplen, as that’s the number of bytes of packet data that was captured) values for all the packets.

You say eth0, so the link-layer header type is probably Ethernet, and there is, for example, no radio meta-data, as might be the case if you were capturing in monitor mode on a Wi-Fi adapter. In the cases where there’s extra meta-data in the link-layer header, you’d need to subtract that.