When I tcpdump the network traffic on my ubuntu server, I see the free memory decreasing with time.
It seems that the captures are stored in memory. At first, I noticed the problem because i was saving the captures in /tmp folder which is stored in RAM.
I then stored the capture on disk but I see the same issue; And as soon as I delete the on-disk captures, the RAM memory is freed !
Here is the tcpdump command
sudo tcpdump -i lo -W 300 -C 100 -s0 -w /home/user/file.pcap &
// BEFORE free -m total used free shared buff/cache available Mem: 14683 3422 6709 153 4551 10745 Swap: 0 0 0
// DELETING THE CAPTURES rm /home/user/file.pcap*
// AFTER free -m total used free shared buff/cache available Mem: 14683 3399 8267 153 3016 10768
How can I make sure the captures are not taking all the free memory available ?
The goal is to let the tcpdump run during several days.