Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I created a tcpdump file:

tcpdump -i eth0 host -n -s 0 -vvv -w /tmp/dump.dmp

duration was about 3 hours.

This file now has 450 MB. Can I say now that the IP generated 450 MB traffic in 3 hours?

share|improve this question
up vote 7 down vote accepted

Yes, maybe, not necessarily.

A pcap file is not simply a byte-for-byte representation of the traffic that was sent/received. Things that will contribute to inaccuracies include:

  • pcap file overhead. Every packet is timestamped, for instance.
  • Impedance mismatch between pcap's idea of a "packet" and your understanding of what constitutes a "packet". The pcap file will have everything including the link-layer header, which is rarely considered part of a customer's traffic allowance for billing purposes.
  • Missing packets. The pcap layer makes no assurances that all packets will actually be transferred into tcpdump's gentle care. Many packets may have been dropped (for a variety of reasons), and they won't be a part of the count you see.

If you want to account for traffic, do it properly, with port or netflow statistics retrieved from your core.

share|improve this answer
thx. so you mean just adding a port, for example port 110 to the tcpdump comment? – Danzzz Aug 10 '12 at 1:08
@Danzzz - no, he means performing your accounting on switch ports. This has nothing to do with IP ports. – EEAA Aug 10 '12 at 1:20

I would say yes. As it is my understanding the writer (-w) writes the packets byte-for-byte to /tmp/dump.dmp. But I'm only 80% sure...

That would include header information also, but that should be calculated into the throughput statistic.

share|improve this answer
I don't know why I didn't think of this before, but it's also worth mentioning that the "-n" and "-vvv" is unnecessary until you read (-r) the /tmp/dump.dmp. Not sure about the "-s" so I usually leave it in. I've not run into a situation where it was totally necessary. – reasra Aug 11 '12 at 18:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.