Red Hat Enterprise Linux Server release 6.5 when saving a
tcpdump capture to a file with the
-w option, the resulting file is empty:
[root@plop ~]# tcpdump -n -w tcpdump.cap listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes ^C217 packets captured 217 packets received by filter 0 packets dropped by kernel [root@plop ~]# cat tcpdump.cap [root@plop ~]# ll tcpdump.cap -rw-r-----. 1 root root 0 Aug 25 14:13 tcpdump.cap [root@plop ~]#
I also tried to redirect the output of the command with
&>, but I always get an empty file...
What could be the reason for this?
- I can see a correct output in the terminal (many packets) when not redirecting to a file
- I did the same with
thsarkand it worked as expected (the output file was correct)
- The verison of
tcpdump version 4.1-PRE-CVS_2012_02_01
- The version of
libpcap version 1.4.0
- I tried with
-Uoption, it didn't fix the problem.