2

I am monitoring a certain port, because my application uses that port, it seems that the connection drops at random times, I want to see what are the last packets passing through before the connection drops: I used this line

 sudo tcpdump -XX -i eth0 port 3050 | tail  >> tcpamir.txt

but for it to work I have to start another terminal and issue

sudo killall tcpdump

is there a better approach? EDIT1: it is important to capture only the last packets since I don't want the file to balloon, since there is enough traffic to fill the disk space quickly .

2 Answers 2

2

Ok I think I've found a solution:

sudo tcpdump -XX -i eth0 -w tcpamir-%s.txt -G 10 port 3050

This rotates your output file every 10 seconds to a new file called tcpamir-<unixtimestamp>.txt

You can also modify the output file, so it overwrites itself every day, if you are worried about the pending file size. For more information read man 3 strftime.

I think of something like

sudo tcpdump -XX -i eth0 -w tcpamir-%R.txt -G 86400

Where %R gives the time in 24-hour notation (12:40 e.g.).

Read relevant output files with

sudo tcpdump -r tcpamir-<unixtimestamp>.txt

Second solution:

Split it into more commands and save it as a script/function:

sudo tcpdump -XX -i eth0 port 3050 >> tcptmp.txt
sudo tail -n100 tcptmp.txt >> tcpamir.txt
sudo rm tcptmp.txt
2
  • do you think it is possible to just make it rotate on itself ? as in remove the -%R from the file ? would it just rewrite ? Commented Jun 20, 2014 at 18:51
  • I tried, but it somehow stays at 0. If you go with the above cmd, it should work, but also log for 24 hours and overwrite/delete all log info at the 24h mark.
    – polym
    Commented Jun 20, 2014 at 18:53
0

If you only want to write all traffic captured you only have to add -w to the line removing '| tail >> tcpamir.txt'

# tcpdump -XX -i eth0 port 3050 -w tcpamir.cap

If you would analize the capture in wireshark the extension must be .cap When you ensure that the capture is done, you could kill this with ctrl + c

NOTE: -w [filename.cap] to write the capture into a file

4
  • but this way,the file will be way to big as it might be 24h before the error happens, and storage is limited Commented Jun 20, 2014 at 18:14
  • So you are worried about the total size & not the way to write the output without killing the PID with an other terminal?
    – tachomi
    Commented Jun 20, 2014 at 18:18
  • size is the reason i used tail in such a way, but i dont like the way i did it. i feel that there must be a better way. Commented Jun 20, 2014 at 18:23
  • what do you say about my suggestion?
    – polym
    Commented Jun 20, 2014 at 18:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .