Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been using tcpdump without any issues before this error popped up. I use the following two commands with variations as soon as my server is attacked so the packets automatically get dumped if the packet rate is high.

tcpdump -i eth0 -p -nn -s0 -c 2000 -w $dumpdir/dump.`date +"%Y%m%d-%H%M%S"`.cap
tcpdump -nn -s0 -c 2000 -w $dumpdir/dump.`date +"%Y%m%d-%H%M%S"`.cap

The following error shows up in console as soon as I'm under attack:

tcpdump: can't create rx ring on packet socket: Cannot allocate memory

Using the command manually works so my guess is that something gets overloaded in the event of an attack. Here is my RAM usage though:

root@x:~# free -m
             total       used       free     shared    buffers     cached
Mem:          2004       1255        749          0          1         29
-/+ buffers/cache:       1225        779
Swap:         2047       1095        952

And currently, it is much lower than it used to be when the command worked.

So anyone with an answer to this?

share|improve this question
Anyone got any idea about this? – Asad Moeen Oct 5 '13 at 18:54
up vote 0 down vote accepted

This is probably caused by system getting out of enough memory. I noticed it worked when a high amount of RAM was present.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.