#!/bin/sh
#
# /usr/local/bin/capture [start | stop]
#
# by Woody A. Poolson 06Sep99
#
# captures live data across the network to a capture file named after
# the date and time.
#
# This script can stand alone or be used as part of the
# syslog/swatch/tripwire script for doing automated and unattended captures.
#
# The /usr/log/"capture files" was chosen so that a runaway capture would
# not "break" the /var partition.  Found this out the hard way before...
#
# Set up variables below...
#

DUMP_FILE=/usr/log/`date "+%m%d.%H%M"`
CAPTURE_PID=/var/run/capture.pid
NIC=xl0

# the only choices are to start and stop.
# the argument is simply passed at the command line or within another
# script
#

case "$1" in

# the capture starts by doing the tcpdump and then "cooking" it for
# the headers in a nice layout of each packet.
#
# the next event clears the process ID file so that it is clean.
# finally, the PID is pulled from a ps and then redirected into the PID file.
#

start)
        /usr/sbin/tcpdump -i $NIC -s 1518 -lenx | /usr/local/bin/tcpshow -cooked
 > $DUMP_FILE &
        cat /dev/null > $CAPTURE_PID
        ps -ax | grep tcpdump | awk '{ print $1 }' > $CAPTURE_PID
        ;;

# to stop the capture that is started earlier, the pid file is read
# then killed.  The sleep 1 second is to let things settle down before
# clearing the PID file.
stop)
        kill `cat $CAPTURE_PID`
        sleep 1
        cat /dev/null > $CAPTURE_PID
        ;;

*)
        echo "usage: $0 {start|stop}" 1>&2
        exit
        ;;

esac