Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am debugging a problem where two servers get stuck in a loop when communicates with each other. After a server restart the problem will start at some point, it can be in an hour or in a day. I want to tcpdump the traffic when the problem starts so I can find out what makes it happen.

My plan is to restart the servers then let tcpdump capture the traffic and then analyze the result. However I would like tcpdump to stop after a few thousand packets captured to avoid having to monitor it, since I don't know when the traffic will start.

Anyone having a suggestion?

share|improve this question
up vote 6 down vote accepted

See man tcpdump:

-c Exit after receiving count packets.

share|improve this answer
I am not sure how I could have missed that in the man page. – ygram Jul 21 '12 at 12:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.