I'm working on a pi device that I can plug into the network and it will automatically start packet capturing to a rotating file. The idea behind the device is that when one of my clients is having a very inconstant issue with an endpoint that they can plug the device into an a mirror port and leave it running until the issue happens, at which point they can unplug the pi and send it back to me for analysis.
The issue that I'm having is that when I boot the Pi back up again to take a look at the pcap files that it traced, it appears that they are all 0 packet size.
I'm using the following command to execute this:
tcpdump -i eth0 -U -W 10 -C 500 -w /opt/tcpdump/packetcapture-$(date +%Y%m%d.%H:%M:%S).pcap
It appears as though it is writing to the file when I actually have my little tcpdump service running:
-rw-r--r-- 1 root root 104439843 24 Nov 9 11:42 packetcapture-20211109.11:42:41.pcap0
but when I pull the power plug on the device and reboot it I'm greeted with the following:
-rw-r--r-- 1 root root 24 Nov 9 11:42 packetcapture-20211109.11:42:41.pcap0
I'm really curious as to why? It really appears to be writing it to the disk and if I end my service before rebooting then the file has data in it.
Am I doing something more fundamentally wrong here?