I am monitoring a certain port, because my application uses that port, it seems that the connection drops at random times, I want to see what are the last packets passing through before the connection drops: I used this line

 sudo tcpdump -XX -i eth0 port 3050 | tail  >> tcpamir.txt

but for it to work I have to start another terminal and issue

sudo killall tcpdump

is there a better approach? EDIT1: it is important to capture only the last packets since I don't want the file to balloon, since there is enough traffic to fill the disk space quickly .


Ok I think I've found a solution:

sudo tcpdump -XX -i eth0 -w tcpamir-%s.txt -G 10 port 3050

This rotates your output file every 10 seconds to a new file called tcpamir-<unixtimestamp>.txt

You can also modify the output file, so it overwrites itself every day, if you are worried about the pending file size. For more information read man 3 strftime.

I think of something like

sudo tcpdump -XX -i eth0 -w tcpamir-%R.txt -G 86400

Where %R gives the time in 24-hour notation (12:40 e.g.).

Read relevant output files with

sudo tcpdump -r tcpamir-<unixtimestamp>.txt

Second solution:

Split it into more commands and save it as a script/function:

sudo tcpdump -XX -i eth0 port 3050 >> tcptmp.txt
sudo tail -n100 tcptmp.txt >> tcpamir.txt
sudo rm tcptmp.txt
  • do you think it is possible to just make it rotate on itself ? as in remove the -%R from the file ? would it just rewrite ? Jun 20 '14 at 18:51
  • I tried, but it somehow stays at 0. If you go with the above cmd, it should work, but also log for 24 hours and overwrite/delete all log info at the 24h mark.
    – polym
    Jun 20 '14 at 18:53

If you only want to write all traffic captured you only have to add -w to the line removing '| tail >> tcpamir.txt'

# tcpdump -XX -i eth0 port 3050 -w tcpamir.cap

If you would analize the capture in wireshark the extension must be .cap When you ensure that the capture is done, you could kill this with ctrl + c

NOTE: -w [filename.cap] to write the capture into a file

  • but this way,the file will be way to big as it might be 24h before the error happens, and storage is limited Jun 20 '14 at 18:14
  • So you are worried about the total size & not the way to write the output without killing the PID with an other terminal?
    – tachomi
    Jun 20 '14 at 18:18
  • size is the reason i used tail in such a way, but i dont like the way i did it. i feel that there must be a better way. Jun 20 '14 at 18:23
  • what do you say about my suggestion?
    – polym
    Jun 20 '14 at 18:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.