[System|Toolbox] Tools
for the Art
of System
Administration
HOME STAFF FAQ ADVERTISE LEGAL
Timed Execution of TCPDUMP
Elmo Recio
Tuesday May 08, 2012 01:00 AM
Again this goes into the, I-cannot-forget-this-because-i-rarely-use-it-but-will-need-it-eventually... if you need to execute tcpdump for a limited amount of time it's very easy with the combination of two switches...Read On!

Again this goes into the, I-cannot-forget-this-because-i-rarely-use-it-but-will-need-it-eventually... if you need to execute tcpdump for a limited amount of time it's very easy with the combination of two switches: "-G" and "-W". Basically you tell tcpdump to run for a certain number of seconds, and when it's done rotating a max # of files, exit gracefully.

 

$ sudo tcpdump -w foo -i eth0 -n -G 60 -W 1


Will exit tcpdump after 60 seconds.

$ sudo tcpdump -w foo.%s -n -i eth0 -G 5 -W 3


This will create three files of five seconds a piece then exist gracefully. Each file will have the suffix of epoch. This is what I am looking for most of the time though - with varying lengths of times (i.e.: 6 files of 300 seconds)

$ sudo tcpdump -Z root -w foo.%s -n -i eth0 -G 5 -W 3


"-Z root" is needed because by default before opening a file which is to be rotated it drop privileges. Not necessary if you have that "%s" because it'll just create a new file each time, but needed if you have a ring buffer. (Use the -C option).
And lastly some versions of tcpdump don't capture the entire packet by default. You sometimes need to tack on "-s 65535" to see the full packet.

Sections
   Comments
   History

Toolboxes
Windows
Unix
Novell
Linux
OSX
Networking
General
Virtualization
Operations Management

Submit
   Comment
   Article
   Tool
   Link

Comment? - Or do you think this article blows chunks and you could write a better one in your sleep? Then do it!
View Comment Page

Copyright © 2004, The Binary Freedom Project, LLC.