I am debugging a problem where two servers get stuck in a loop when communicates with each other. After a server restart the problem will start at some point, it can be in an hour or in a day. I want to tcpdump the traffic when the problem starts so I can find out what makes it happen.

My plan is to restart the servers then let tcpdump capture the traffic and then analyze the result. However I would like tcpdump to stop after a few thousand packets captured to avoid having to monitor it, since I don't know when the traffic will start.

Anyone having a suggestion?


See man tcpdump:

-c Exit after receiving count packets.

  • I am not sure how I could have missed that in the man page. – ygram Jul 21 '12 at 12:14

Type the command below:

sudo tcpdump -i eno1 -c [size]

The argument -i eno1 tells tcpdump to listen only on the eno1 interface, and -c [size] tells tcpdump to stop capturing after [size] packages have been captured. So tcpdump -i eno1 -c 2048 will stop after 2048 packages.

  • you might want to add what parameter does what, especially given that the interface -i is not always named what you typed. Additionally the answer to the question is already accepted including the source so your answer seems not to add anything relevant to the question, which might be the reason you got downvoted. – Dennis Nolte Feb 7 '19 at 9:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.