How to record only the header info when using `tcpdump`

Question

When running the following command

tcpdump -i deviceName 'host 1.2.3.4' -q -w /mypath/dump.pcap

the dump file contains a huge amount of data because there's a lot of traffic. However, I only need to save the header details of each packet, not the entire contents. I tried using the -q switch (for "quiet") but that's not helping.

I need Time, Source, Destination, Protocol and Length. I do not need any of the other information, and especially not the full contents of each packet.

If there's a way to ignore the contents and only write the header details to disk so as to save space? I'm getting to over a GB in a matter of minutes :(

I've seen many questions about how to increase the amount of data saved, but nothing for reducing it. Am I barking up the wrong tree?

Solution

I was in the same situation and I solved it by adding -s 96

Comments

[Sjoerd]

See also How do I use tcpdump to capture all traffic headers.

[Bodo]

See option -s snaplen or --snapshot-length=snaplen. See tcpdump.org/manpages/tcpdump.1.html. They seem to have increased the default. (I remember that in old times I often had to increase the value which was less than 100 at this time.)

[Dan Rayson]

I was under the impression that snaplen would only record information regarding packets below a certain size, not that it would limit what was saved to file. I'll take a look and get back to you. Thanks guys.

[Rui F Ribeiro]

Local login or remote ssh session?

[Dan Rayson]

@RuiFRibeiro I'm running the commands using PuTTY, if I'm honest I don't know what protocol that is, probably SCP, though.

[Dan Rayson]

Thanks Zatarra, adding this really simple bit sorted it out for me. I still get all the info I need but without the nasty overhead. Cheers!