2

I'm currently running a continuous tcpdump job with the following command:

tcpdump -pni en4 -G 3600 -w 'data/trace_%Y-%m-%d_%H:%M:%S.pcap'

It runs very well over long periods of time, creating one pcap file per hour.

However if there is any kind of disruption to the physical link, tcpdump exits with the following error:

tcpdump: pcap_loop: The interface went down

Is there any way for tcpdump to remain running despite the intermittent physical interface disconnection? If not, what strategy would you suggest to catch this error and restart tcpdump on interface reconnection?

1 Answer 1

2

Why not wrap it with bash script?

#!/bin/bash

while true
do
   echo tcpdump restarted at $(date)
   tcpdump -pni en4 -G 3600 -w 'data/trace_%Y-%m-%d_%H:%M:%S.pcap'
   sleep 3
done

This will keep tcpdump running

1
  • This would definitely work. The only downside is that I like to keep the log files started at the hour mark (I start the tcpdump with the at command, which then rotates the files every 60 minutes). Using the bash script would mean switching to a logrotate solution as opposed to the -G flag.
    – ktorn
    Commented Apr 11, 2016 at 3:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .