2
tcpdump -i eth0 -C 5 -W 1 -w <file name>&

I use the command above to capture packets to a 5MB pcap file on an Ubuntu machine. Once the pcap file reaches the maximum size (5MB), the file gets rotated and starts again from 0KB.

I need to know whether we can stop the tcpdump from rotating the file once it reaches its max size and drop the packets from then.

terdon
  • 242,166
Karthick
  • 71
  • 1
    You can limit the number of packets captured and the seconds, I think. No ideia how to make it stop after capturing n bytes. – Rui F Ribeiro Dec 06 '17 at 13:35
  • From the man page section on -W option: "Used in conjunction with the -G option, this will limit the number of rotated dump files that get created, exiting with status 0 when reaching the limit." I've never used this option, but looks like a potential basis for an answer. – user4556274 Dec 06 '17 at 13:39
  • @user4556274 I was also reading it, and it is a bit obscure. Feel free to add an answer if you are confy with it. – Rui F Ribeiro Dec 06 '17 at 13:49

3 Answers3

0

I found a way!!!!

We can do a hack in tcpdump as below

tcpdump -i eth0 -C 5 -W 2 -w my.pcap -z ./stop.sh&

stop.sh

# !/bin/sh
pkill tcpdump
rm my.pcap0

and it worked for me......

AdminBee
  • 22,803
Karthick
  • 71
0

If you have access to wireshark/tshark:

tshark -i eth0 -a filesize:5000 -w my.pcap &
slass100
  • 183
0

looks like tcpdump (4.9.2) only honors file count (-W) when used together with capture time (-G). the other way to capture to only one file is by limit packet count (-c). tcpdump seems not be able to write to a non-rotating file limited by size (-C).

according to source code there is this exit statement

if (Cflag == 0 && Wflag > 0 && Gflag_count >= Wflag) {
    (void)fprintf(stderr, "Maximum file limit reached: %d\n",
        Wflag);
    info(1);
    exit_tcpdump(0);
    /* NOTREACHED */
}

which tests especially Cflag (file size) to be zero.

example 1: by packet count

# tcpdump -vi any -w ./count.pcap -c 42 ip

example 2: by capture time

# tcpdump -vi any -w ./time.pcap -G 7 -W 1 ip

result: 1 file each

# ls
count.pcap  time.pcap

HTH

StefanKaerst
  • 329