From owner-freebsd-questions  Tue Apr 30 23:35:32 2002
Delivered-To: freebsd-questions@freebsd.org
Received: from rwcrmhc53.attbi.com (rwcrmhc53.attbi.com [204.127.198.39])
	by hub.freebsd.org (Postfix) with ESMTP id 13B7337B417
	for <freebsd-questions@FreeBSD.ORG>; Tue, 30 Apr 2002 23:35:25 -0700 (PDT)
Received: from blossom.cjclark.org ([12.234.91.48]) by rwcrmhc53.attbi.com
          (InterMail vM.4.01.03.27 201-229-121-127-20010626) with ESMTP
          id <20020501063520.KEDE5896.rwcrmhc53.attbi.com@blossom.cjclark.org>;
          Wed, 1 May 2002 06:35:20 +0000
Received: (from cjc@localhost)
	by blossom.cjclark.org (8.11.6/8.11.6) id g416ZJU62823;
	Tue, 30 Apr 2002 23:35:20 -0700 (PDT)
	(envelope-from cjc)
Date: Tue, 30 Apr 2002 23:35:19 -0700
From: "Crist J. Clark" <crist.clark@attbi.com>
To: Fernando Gleiser <fgleiser@cactus.fi.uba.ar>
Cc: freebsd-questions@FreeBSD.ORG
Subject: Re: tcpdump(8) filtered by time
Message-ID: <20020430233518.C57470@blossom.cjclark.org>
Reply-To: cjclark@alum.mit.edu
References: <20020430110056.B55983@blossom.cjclark.org> <20020430165309.R85537-100000@localhost>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: <20020430165309.R85537-100000@localhost>; from fgleiser@cactus.fi.uba.ar on Tue, Apr 30, 2002 at 04:55:43PM -0300
X-URL: http://people.freebsd.org/~cjc/
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-questions.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-questions>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-questions>
X-Loop: FreeBSD.ORG

On Tue, Apr 30, 2002 at 04:55:43PM -0300, Fernando Gleiser wrote:
> On Tue, 30 Apr 2002, Crist J. Clark wrote:
> 
> > Slightly off-topic, but I'd like see if anyone has any ideas.
> >
> > I have a tcpdump(8) file that spans a few hours. I want to isolate
> > an hour somewhere in the middle and dump it to a new file. I can't
> > figure out how to do this.
> 
> Doesn't tcpslice do something like that?

D'oh! Thanks. We all need to be reminded of the obvious sometimes.
-- 
Crist J. Clark                     |     cjclark@alum.mit.edu
                                   |     cjclark@jhu.edu
http://people.freebsd.org/~cjc/    |     cjc@freebsd.org

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message