6

I am debugging a problem where two servers get stuck in a loop when communicates with each other. After a server restart the problem will start at some point, it can be in an hour or in a day. I want to tcpdump the traffic when the problem starts so I can find out what makes it happen.

My plan is to restart the servers then let tcpdump capture the traffic and then analyze the result. However I would like tcpdump to stop after a few thousand packets captured to avoid having to monitor it, since I don't know when the traffic will start.

Anyone having a suggestion?

Improve this question

2 Answers 2

Reset to default
13

See man tcpdump:

-c Exit after receiving count packets.

Improve this answer
1
  • I am not sure how I could have missed that in the man page.
    – ygram
    Jul 21, 2012 at 12:14
-2

Type the command below:

sudo tcpdump -i eno1 -c [size]

The argument -i eno1 tells tcpdump to listen only on the eno1 interface, and -c [size] tells tcpdump to stop capturing after [size] packages have been captured. So tcpdump -i eno1 -c 2048 will stop after 2048 packages.

Improve this answer
1
  • you might want to add what parameter does what, especially given that the interface -i is not always named what you typed. Additionally the answer to the question is already accepted including the source so your answer seems not to add anything relevant to the question, which might be the reason you got downvoted.
    – Dennis Nolte
    Feb 7, 2019 at 9:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .