0

Looking to port mirror a network firewall interface, connect that interface to a Linux server, and have that Linux server constantly run a tcpdump and storing the output in files.

Specifically, my requirement is to have pcap files saved over and over again as the size of that file reaches a specific number.

For example:

Juniper firewall port 2 mirrors all traffic on port 1. Port 2 connects to eth0 on the Linux server. Linux server has a tcpdump process running constantly on eth0. Linux server is configured to save the traffic to a file named "tcpdump.pcap", but when the pcap file exceeds a specific size, then it will then compress and rename to "tcpdump.pcap.0.gz". As the second file exceeds a specific size, then it will be renamed to "tcpdump.pcap.1.gz", etc.

This will allow me to view network traffic within the past X amount of time (for now, I'm looking to have visibility in the past 72 hours).

The problem here is that I don't know how to accomplish the above. Specifically, how do I get tcpdump to run continously, and automatically save pcaps, and automatically compress and re-name chronologically?

1

Let's break down the problem in the following parts:

  • let tcpdump save the dump in pcap format: you can use the -w option. As alway, read the man page carefully
  • continuously run tcpdump: you can use screen to run tcpdump, than detach/attach at your will; the process will continue to run until you stop it;
  • rotate the logfile: [as per Mark Riddell suggestion] you can use the -C option to let tcpdump rotate the pcap file or, alternatively, you can configure and use logrotate to automatically rename/rotate the logfile when a specific size is reached
  • excellent, will look into this and thanks for the quick response. – lobi Aug 9 '16 at 20:50
  • 2
    Rather than using logrotate, you can use the in-built tcpdump rotation options (also found in the man page). For example, use the -C 10 flag to automatically save to a new pcap file after the current one has exceeded 10MB. This can be combined with the -W 5 option to limit the maximum number of saved captures (working as a ring buffer). – Mark Riddell Aug 9 '16 at 21:32
  • 1
    Very good to know, thank you ;) I'll update the answer with your suggestion. – shodanshok Aug 9 '16 at 22:32

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.