Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am having some problems getting tcpdump to log all internet traffic on an interface with the following limitations:

  • I would like a new pcap file every hour with time and date tag in the name
  • If the pcap file in this hour becomes larger than 100M then create a new pcapfile with the samenametag as before but with a -2 -3 -4 ... suffix.

I am playing around with the following command:

tcpdump -pni eth0 -s65535 -G 3600 -C 100 -w '/var/log/tcpdump/trace_%Y-%m-%d_%H:%M:%S.pcap'

As a result I do get a log file every hour but it does not seem to split the file if it becomes larger than 100.

Does anyone know where I am messing up? Cheers for the help

share|improve this question
    
copy version strings from tcpdump -h please –  GioMac Sep 11 '13 at 15:59
    
tcpdump version 4.1.1 libpcap version 1.1.1 –  user2284355 Sep 11 '13 at 18:49
    
works for me with latest versions –  GioMac Sep 11 '13 at 19:33
    
I have been testing also with a new file every 20 seconds and a max file size of 1kb. Is -C 0.001 correct for 1kb? –  user2284355 Sep 11 '13 at 20:29
    
You were right. Latest version works for me too. Cheer for your help –  user2284355 Sep 11 '13 at 20:56

1 Answer 1

up vote 2 down vote accepted

Your command should work, maybe there's a bug.

Use tshark (wireshark package) instead:

tshark -i eth0 -b duration:3600 -b filesize:102400 -s 65535 -w trace.pcap

The created filenames are based on the filename given with the -w option, the number of the file and on the creation date and time, e.g. outfile_00001_20050604120117.pcap, outfile_00002_20050604120523.pcap, ...

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.