Question

我有一个bash脚本，我把它放在一起，根据一个普通的过滤器合并多个数据包捕获。我在后端运行daemonlogger，它根据大小滚动pcap文件，因此很难得到整个图片，因为我正在寻找的数据可能在一个pcap文件中，其余的在另一个...最大的抱怨我有无法加速这个过程。它一次只能处理一个pcap。有没有人有任何建议如何加快多个子进程或多线程的速度？

#!/bin/bash
echo '[+] example tcp dump filters:'
echo '[+] host 1.1.1.1'
echo '[+] host 1.1.1.1 dst port 80'
echo '[+] host 1.1.1.1 and host 2.2.2.2 and dst port 80'
echo 'tcpdump filter:'
read FILTER
cd /var/mycaps/
DATESTAMP=$(date +"%m-%d-%Y-%H:%M")
# make a specific folder to drop the filtered pcaps in
mkdir /var/mycaps/temp/$DATESTAMP
# iterate over all pcaps and check for an instance of your filter
for file in $(ls *.pcap); do
        tcpdump -nn -A -w temp/$DATESTAMP/$file -r $file $FILTER
        # remove empty pcaps that dont match
        if [ "`ls -l temp/$DATESTAMP/$file | awk '{print $5}'`" = "24" ]; then
                rm -f "temp/$DATESTAMP/$file"
        fi
done
echo '[+] Merging pcaps'
# cd to your pcap directory 
cd /var/mycaps/temp/${DATESTAMP}
# merge all of the pcaps into one file and remove the seperated files
mergecap *.pcap -w merged.pcap
rm -f original.*
echo "[+] Done. your files are in $(pwd)"

Answer 1

在后台运行循环体，然后等待所有后台作业完成后再继续。

max_jobs=10   # For example
job_count=0
for file in *.pcap; do   # Don't iterate over the output of ls
    (tcpdump -nn -A -w temp/"$DATESTAMP"/"$file" -r "$file" $FILTER
    # remove empty pcaps that don't match. Use stat to get the file size
    if [ "$(stat -c "%s")" = 24 ]; then
            rm -f "temp/$DATESTAMP/$file"
    fi
    ) &
    job_count=$((job_count+1))
    if [ "$job_count" -gt "$max_jobs" ]; then
        wait
        job_count=0
    fi
done
wait

用多线程加速bash脚本？

1 个答案: