| June 5, 2009 | ||
| 7:00 pm | to | 10:00 pm |
The meeting is a GO for June 5th, 2009. Place and time are the Brewhouse at 7:00 PM. We presently have one talk scheduled:
Extracting PE files from PCAP
We will extract a standalone executable file from captured stream over the network. Slides and demo goodness abound.
Bio:
eighty was born in the middle of a tornado and given a 75% chance to live. He also ran with the biggest rock stars of the 80s.
Speaking of tcpdump, Looking at the old slides, what is the command to cause tcpdump to capture all and roll files, per presentation.
-C file_size
In this case, file size is expressed in millions of bytes. So if you want it to roll over after 2 million bytes, it would be -C 2. To test this, in screen I kicked off:
sudo tcpdump -n -i lo -s 0 -C 1 -w testlol.pcap
Then in another screen instance (for the lulz):
sudo ping -f localhost