2

On my Red Hat Enterprise Linux Server release 6.5 when saving a tcpdump capture to a file with the -w option, the resulting file is empty:

[root@plop ~]# tcpdump -n -w tcpdump.cap
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
^C217 packets captured
217 packets received by filter
0 packets dropped by kernel
[root@plop ~]# cat tcpdump.cap
[root@plop ~]# ll tcpdump.cap
-rw-r-----. 1 root root 0 Aug 25 14:13 tcpdump.cap
[root@plop ~]#

I also tried to redirect the output of the command with > and &>, but I always get an empty file...

What could be the reason for this?

NB:

  • I can see a correct output in the terminal (many packets) when not redirecting to a file
  • I did the same with thsark and it worked as expected (the output file was correct)
  • The verison of tcpdump is tcpdump version 4.1-PRE-CVS_2012_02_01
  • The version of libpcap is libpcap version 1.4.0
  • I tried with -U option, it didn't fix the problem.
7
  • Does the behavior change if you add the -l or -U flag?
    – Jeff Schaller
    Aug 25, 2015 at 10:18
  • @JeffSchaller No, it doesn't.
    – sdabet
    Aug 25, 2015 at 12:13
  • Do you have any output in the terminal when you don't try to redirect it elsewhere? Aug 25, 2015 at 12:22
  • @JohnWHSmith Yes I do. See my edit.
    – sdabet
    Aug 25, 2015 at 12:33
  • 1
    @steve You're right, disk full! Please create an answer, I will happily accept it :)
    – sdabet
    Aug 25, 2015 at 12:48

5 Answers 5

4

Try to add the -U option.

From the man page:

   -U
   --packet-buffered
          If  the  -w option is not specified, make the printed packet output ``packet-buffered''; i.e., as the description of the contents of each packet is printed, it will be written to the standard
          output, rather than, when not writing to a terminal, being written only when the output buffer fills.

      If the -w option is specified, make the saved raw packet output ``packet-buffered''; i.e., as each packet is saved, it will be written to the output file, rather than being written only  when
      the output buffer fills.

      The -U flag will not be supported if tcpdump was built with an older version of libpcap that lacks the pcap_dump_flush() function.
3
  • 1
    Nice try...but that still doesn't work.
    – sdabet
    Aug 25, 2015 at 11:57
  • Try to specify the interface(s) e.g. tcpdump -ni eth0
    – dr_
    Aug 25, 2015 at 12:05
  • I've tried that too.
    – sdabet
    Aug 25, 2015 at 12:12
3

There's a known issue with tcpdump where if it fails to write to the output file (e.g. permissions or disk full) it does not report this fact.

In this case, as the output file is being created ok but no data being written, so the filesystem is likely full.

Can be confirmed by rerunning via strace and observing the write fail.

Solution is to clear space in relevant filesystem or point tcpdump at a filesystem where space exists.

1

I used this cmd: sudo tcpdump -v -w ~/Desktop/tout_135.pcap -i eth0 host 10.211.55.*

and the file gets generated with no data but chmod 700 or whatever you want to give permission to. Run the tcpdump again, and voila!!! data gets generated!

0
  1. Update your tcpdump version: sudo yum install tcpdump

  2. When I used command tcpdump -n -i "ens1f0" -e -c 20 -Q in -U -w /home/test.pcap - part of our tests created with empty pcap too. I removed part of filters and it started to create correct pcap files. This is a last version: tcpdump -n -i "ens1f0" -w /home/test.pcap

-1

Make sure tcpdump is watching the right network interface. Or use -i any to watch on any interface.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .