I have a Adapter installed and working on RHEL server which faces disconnection when a particular signal message is sent from the Source to which this adapter is connected. In order to capture the raw packets from the Source IP address I am using the tcpdump utility. However, the problem with using tcpdump is that it continuously captures all the packets from the source including the traffic in which I am not interested. This leads to huge disk space utilization because there is a huge incoming of data from the source IP address on this particular port which is used for communication between my adapter and the source server.Is there a way or default Linux utility which can be used to capture only those packets which have a specific string eg. eventLossOccurred so that at the end, I just have those packets captured which contains those messages? I have searched the various options for tcpdump however, I didn't find a way to get the desired results using this utility.
How to capture Network traces containing only a specific string?
linux;networking;linux kernel;tcp;tcpdump