Capture network traffic, without the data component of TCP packets.

Hi
I am testing how much data flows between 2 servers (Server 2003, File
Replication), using Ethereal. The problem is that the log files get
very large very fast, as libcat/tcpdump files include all the data as
well as the TCP information.

Is there a way I can capture all of the TCP info (source IP+mac,
protocol etc), WITHOUT capturing the actual DATA part of the packet?
I want to capture a whole days worth of traffic, and then analyse the
peak times etc.

Thanks,
Nick

You can configure a pre-capture filter in ethereal to limit the data
that it captures. Read more here:
http://www.ethereal.com/docs/user-gu...erSection.html

Good Luck,
Rick Gouin, MCSE

I realise that you can use capture filters with Ethereal.

99% of the traffic is IP traffic between ServerA and ServerB
(synchronising files). Yes we could filter out traffic from other
computers, or filter out ARP traffic, but the reduction would be
negligible.

Can anyone recommend a technique to capture the details of the
traffic, but not the actual DATA component of the traffic?

Thanks
Nick