0

Looking to port mirror a network firewall interface, connect that interface to a Linux server, and have that Linux server constantly run a tcpdump and storing the output in files.

Specifically, my requirement is to have pcap files saved over and over again as the size of that file reaches a specific number.

For example:

Juniper firewall port 2 mirrors all traffic on port 1. Port 2 connects to eth0 on the Linux server. Linux server has a tcpdump process running constantly on eth0. Linux server is configured to save the traffic to a file named "tcpdump.pcap", but when the pcap file exceeds a specific size, then it will then compress and rename to "tcpdump.pcap.0.gz". As the second file exceeds a specific size, then it will be renamed to "tcpdump.pcap.1.gz", etc.

This will allow me to view network traffic within the past X amount of time (for now, I'm looking to have visibility in the past 72 hours).

The problem here is that I don't know how to accomplish the above. Specifically, how do I get tcpdump to run continously, and automatically save pcaps, and automatically compress and re-name chronologically?

1 Answer 1

1

Let's break down the problem in the following parts:

  • let tcpdump save the dump in pcap format: you can use the -w option. As alway, read the man page carefully
  • continuously run tcpdump: you can use screen to run tcpdump, than detach/attach at your will; the process will continue to run until you stop it;
  • rotate the logfile: [as per Mark Riddell suggestion] you can use the -C option to let tcpdump rotate the pcap file or, alternatively, you can configure and use logrotate to automatically rename/rotate the logfile when a specific size is reached
3
  • excellent, will look into this and thanks for the quick response.
    – lobi
    Aug 9, 2016 at 20:50
  • 2
    Rather than using logrotate, you can use the in-built tcpdump rotation options (also found in the man page). For example, use the -C 10 flag to automatically save to a new pcap file after the current one has exceeded 10MB. This can be combined with the -W 5 option to limit the maximum number of saved captures (working as a ring buffer). Aug 9, 2016 at 21:32
  • 1
    Very good to know, thank you ;) I'll update the answer with your suggestion.
    – shodanshok
    Aug 9, 2016 at 22:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .