2
tcpdump -i eth0 -C 5 -W 1 -w <file name>&

I use the command above to capture packets to a 5MB pcap file on an Ubuntu machine. Once the pcap file reaches the maximum size (5MB), the file gets rotated and starts again from 0KB.

I need to know whether we can stop the tcpdump from rotating the file once it reaches its max size and drop the packets from then.

3
  • 1
    You can limit the number of packets captured and the seconds, I think. No ideia how to make it stop after capturing n bytes. Dec 6, 2017 at 13:35
  • From the man page section on -W option: "Used in conjunction with the -G option, this will limit the number of rotated dump files that get created, exiting with status 0 when reaching the limit." I've never used this option, but looks like a potential basis for an answer. Dec 6, 2017 at 13:39
  • @user4556274 I was also reading it, and it is a bit obscure. Feel free to add an answer if you are confy with it. Dec 6, 2017 at 13:49

3 Answers 3

0

If you have access to wireshark/tshark:

tshark -i eth0 -a filesize:5000 -w my.pcap &
1
  • No i dont have access..:(
    – Karthick
    Dec 7, 2017 at 9:44
0

I found a way!!!!

We can do a hack in tcpdump as below

tcpdump -i eth0 -C 5 -W 2 -w my.pcap -z ./stop.sh&

stop.sh

# !/bin/sh
pkill tcpdump
rm my.pcap0

and it worked for me......

0

looks like tcpdump (4.9.2) only honors file count (-W) when used together with capture time (-G). the other way to capture to only one file is by limit packet count (-c). tcpdump seems not be able to write to a non-rotating file limited by size (-C).

according to source code there is this exit statement

if (Cflag == 0 && Wflag > 0 && Gflag_count >= Wflag) {
    (void)fprintf(stderr, "Maximum file limit reached: %d\n",
        Wflag);
    info(1);
    exit_tcpdump(0);
    /* NOTREACHED */
}

which tests especially Cflag (file size) to be zero.

example 1: by packet count

# tcpdump -vi any -w ./count.pcap -c 42 ip

example 2: by capture time

# tcpdump -vi any -w ./time.pcap -G 7 -W 1 ip

result: 1 file each

# ls
count.pcap  time.pcap

HTH

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.