I want to create a mini sniffing network. I asked in a previous question about how to capture and decrypt packets in real time.
Now I want to analyze it, and I am developing a script for it but can I do it on the fly? Like when dumpcap is running and writing to file can I read it at the same time and analyze new appended packets? Or is there a better way of sniffing and analyzing at the same time?
I will use two raspberry pi 2's. One for sniffing and saving pcaps and other for reading, analyzing and populating a database with extracted info.