tcpdump --- capture packets to a non-rotating file

Question

tcpdump -i eth0 -C 5 -W 1 -w <file name>&

I use the command above to capture packets to a 5MB pcap file on an Ubuntu machine. Once the pcap file reaches the maximum size (5MB), the file gets rotated and starts again from 0KB.

I need to know whether we can stop the tcpdump from rotating the file once it reaches its max size and drop the packets from then.

Answer 1

If you have access to wireshark/tshark:

tshark -i eth0 -a filesize:5000 -w my.pcap &

Answer 2

I found a way!!!!

We can do a hack in tcpdump as below

tcpdump -i eth0 -C 5 -W 2 -w my.pcap -z ./stop.sh&

stop.sh

# !/bin/sh
pkill tcpdump
rm my.pcap0

and it worked for me......

Answer 3

looks like tcpdump (4.9.2) only honors file count (-W) when used together with capture time (-G). the other way to capture to only one file is by limit packet count (-c). tcpdump seems not be able to write to a non-rotating file limited by size (-C).

according to source code there is this exit statement

if (Cflag == 0 && Wflag > 0 && Gflag_count >= Wflag) {
    (void)fprintf(stderr, "Maximum file limit reached: %d\n",
        Wflag);
    info(1);
    exit_tcpdump(0);
    /* NOTREACHED */
}

which tests especially Cflag (file size) to be zero.

example 1: by packet count

# tcpdump -vi any -w ./count.pcap -c 42 ip

example 2: by capture time

# tcpdump -vi any -w ./time.pcap -G 7 -W 1 ip

result: 1 file each

# ls
count.pcap  time.pcap

HTH