Question

I have to write a script where I take a tcpdump on my machine and on a remote machine “simultaneously”. That is the beginning of capture (0th second) should be simultaneous, so that I can compare the two tcpdumps in my analysis.

Is there a way I can achieve this?

Answer 1

If you just need approximate time (e.g. with a margin of error in range of, say, 200ms), then just make sure both machines have the same time (e.g. via NTP) and then use e.g. cron to run both commands at the same time.

If you want this to be more often, you might want to use at command instead of cron. You can do some simple date arithmetics, e.g. see this:

• Bash date/time arithmetic

or sleep until the specified time:

• Bash: Sleep until a specific time/date

in both scripts (i.e. local and remote), then run the local command and run the command on the remote machine using ssh.

If you are OK to use e.g. Python, you can make the use of datetime module, e.g. see this:

• http://www.doughellmann.com/PyMOTW/datetime/

The idea is pretty much this:

• Take current time
• Calculate target time – add some cushion seconds (e.g. 10 seconds)
• Run both scripts with that time as the parameter (one locally, one remotely with ssh)
• Sleep until that time in both scripts – if you cannot ssh in 10 seconds or even worse if it takes more than 10 seconds to run local script, you have more serious problems than this one 🙂
• Run tcpdump in both scripts – they should be pretty much synced up (with some tolerance, but I don’t think it will ever go over 50ms on any recent system)

Hope this helps.