1

When I tcpdump the network traffic on my ubuntu server, I see the free memory decreasing with time.

It seems that the captures are stored in memory. At first, I noticed the problem because i was saving the captures in /tmp folder which is stored in RAM.

I then stored the capture on disk but I see the same issue; And as soon as I delete the on-disk captures, the RAM memory is freed !

Here is the tcpdump command

sudo tcpdump -i lo -W 300 -C 100 -s0 -w /home/user/file.pcap &
// BEFORE
free -m
              total        used        free      shared  buff/cache   available
Mem:          14683        3422        6709         153        4551       10745
Swap:             0           0           0
// DELETING THE CAPTURES
rm /home/user/file.pcap*
// AFTER
free -m
              total        used        free      shared  buff/cache   available
Mem:          14683        3399        8267         153        3016       10768

How can I make sure the captures are not taking all the free memory available ?

The goal is to let the tcpdump run during several days.

4

Don't look at the free column when determining available memory; look at available.

Linux will use unused memory as buffer cache for files, to speed up access to those files. You're writing lots of tcpdump packet capture data to the filesystem, so that also gets buffered in memory. When you stop the capture process and delete the file, the buffer cache used for that file also gets freed.

If the system really needs the memory e.g. for process data, then the buffer cache will also be freed up, which will mean that accessing the data in the file will cause the file to be read from disk instead of from the buffer cache.

That is why the available column adds the free and buff/cache columns to give available.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.