I am having some problems getting tcpdump to log all internet traffic on an interface with the following limitations:

  • I would like a new pcap file every hour with time and date tag in the name
  • If the pcap file in this hour becomes larger than 100M then create a new pcapfile with the samenametag as before but with a -2 -3 -4 ... suffix.

I am playing around with the following command:

tcpdump -pni eth0 -s65535 -G 3600 -C 100 -w '/var/log/tcpdump/trace_%Y-%m-%d_%H:%M:%S.pcap'

As a result I do get a log file every hour but it does not seem to split the file if it becomes larger than 100.

Does anyone know where I am messing up? Cheers for the help

  • copy version strings from tcpdump -h please – GioMac Sep 11 '13 at 15:59
  • tcpdump version 4.1.1 libpcap version 1.1.1 – user2284355 Sep 11 '13 at 18:49
  • works for me with latest versions – GioMac Sep 11 '13 at 19:33
  • I have been testing also with a new file every 20 seconds and a max file size of 1kb. Is -C 0.001 correct for 1kb? – user2284355 Sep 11 '13 at 20:29
  • You were right. Latest version works for me too. Cheer for your help – user2284355 Sep 11 '13 at 20:56

Your command should work, maybe there's a bug.

Use tshark (wireshark package) instead:

tshark -i eth0 -b duration:3600 -b filesize:102400 -s 65535 -w trace.pcap

The created filenames are based on the filename given with the -w option, the number of the file and on the creation date and time, e.g. outfile_00001_20050604120117.pcap, outfile_00002_20050604120523.pcap, ...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.