dump_packets.sh

#!/usr/bin/env bash

# hosts filtered out to not catch unwanted traffic
sshhost=""
officeip1=""
officeip2=""
captureport="eth0"
tempfile="/tmp/netsniff"
# only works for ipv4 at this time, will change it later if needed
localip=$(ip -o -4 addr show dev eth1 | sed 's/.* inet \([^/]*\).*/\1/')

startup() {
touch $tempfile
}

cleanup() {
  rm -rf $tempfile
  pkill netsniff-ng
}


capture(){
   startup
   /usr/sbin/netsniff-ng -i $captureport -s -o ~/pcaps/ -H --ring-size 1GiB  --interval 1GiB -f "not host "${sshhost}" and not host "${localip}" and not host "${officeip1}" and not host "${officeip2}""  &
   #/usr/bin/tshark -i ${captureport} -b duration:86400 -w ~/pcaps/capture -q -f "not src "${badhost}" and port not "${mport}" or port not "${sshport}"" &
}

main() {
  if [[ ! -e "$tempfile" ]]; then
     capture
  else
     echo "Capture is already in progress"
  fi
}

main