I'm working on a pi device that I can plug into the network and it will automatically start packet capturing to a rotating file. The idea behind the device is that when one of my clients is having a very inconstant issue with an endpoint that they can plug the device into an a mirror port and leave it running until the issue happens, at which point they can unplug the pi and send it back to me for analysis.

The issue that I'm having is that when I boot the Pi back up again to take a look at the pcap files that it traced, it appears that they are all 0 packet size.

I'm using the following command to execute this:

tcpdump -i eth0 -U -W 10 -C 500 -w /opt/tcpdump/packetcapture-$(date +%Y%m%d.%H:%M:%S).pcap

It appears as though it is writing to the file when I actually have my little tcpdump service running:

-rw-r--r-- 1 root root 104439843 24 Nov  9 11:42 packetcapture-20211109.11:42:41.pcap0

but when I pull the power plug on the device and reboot it I'm greeted with the following:

-rw-r--r-- 1 root root 24 Nov  9 11:42 packetcapture-20211109.11:42:41.pcap0

I'm really curious as to why? It really appears to be writing it to the disk and if I end my service before rebooting then the file has data in it.

Am I doing something more fundamentally wrong here?

1 Answer 1


When you type the ls command before unplugging your PC, you get data from the memory cache. Most programs write file through the cache, then nothing is actually written to the disk after the return of the write syscall. This make the system more efficient.

Sensitive programs like mail server, databases, use a fsync syscall which explicitly demands the file to be synchronised to disk before sending an acknowledgment or continuing to work.

You have the sync command which flush all data in the cache to the disk and return afterward. Try again and don’t unplug the PC before the end of this command.

  • Hi Frederic, I ran the sync command before pulling the power to the device and unfortunately got the same result. The tcpdump was still running though. Is there a way to force tcpdump to write to the disk? Commented Nov 10, 2021 at 19:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .