1
tcpdump -i eth0 -C 5 -W 1 -w <file name>&

I use the command above to capture packets to a 5MB pcap file on an Ubuntu machine. Once the pcap file reaches the maximum size (5MB), the file gets rotated and starts again from 0KB.

I need to know whether we can stop the tcpdump from rotating the file once it reaches its max size and drop the packets from then.

  • 1
    You can limit the number of packets captured and the seconds, I think. No ideia how to make it stop after capturing n bytes. – Rui F Ribeiro Dec 6 '17 at 13:35
  • From the man page section on -W option: "Used in conjunction with the -G option, this will limit the number of rotated dump files that get created, exiting with status 0 when reaching the limit." I've never used this option, but looks like a potential basis for an answer. – user4556274 Dec 6 '17 at 13:39
  • @user4556274 I was also reading it, and it is a bit obscure. Feel free to add an answer if you are confy with it. – Rui F Ribeiro Dec 6 '17 at 13:49
0

I found a way!!!!

we can do a hack in tcpdump as below

tcpdump -i eth0 -C 5 -W 2 -w my.pcap -z ./stop.sh&

stop.sh

!/bin/sh

pkill tcpdump rm my.pcap0

and it worked for me......

0

If you have access to wireshark/tshark:

tshark -i eth0 -a filesize:5000 -w my.pcap &
  • No i dont have access..:( – Karthick Dec 7 '17 at 9:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.