I am having some problems getting tcpdump to log all internet traffic on an interface with the following limitations:
- I would like a new pcap file every hour with time and date tag in the name
- If the pcap file in this hour becomes larger than 100M then create a new pcapfile with the samenametag as before but with a -2 -3 -4 ... suffix.
I am playing around with the following command:
tcpdump -pni eth0 -s65535 -G 3600 -C 100 -w '/var/log/tcpdump/trace_%Y-%m-%d_%H:%M:%S.pcap'
As a result I do get a log file every hour but it does not seem to split the file if it becomes larger than 100.
Does anyone know where I am messing up? Cheers for the help