tcpdump -i eth0 -C 5 -W 1 -w <file name>&
I use the command above to capture packets to a 5MB pcap file on an Ubuntu machine. Once the pcap file reaches the maximum size (5MB), the file gets rotated and starts again from 0KB.
I need to know whether we can stop the tcpdump from rotating the file once it reaches its max size and drop the packets from then.
-W
option: "Used in conjunction with the -G option, this will limit the number of rotated dump files that get created, exiting with status 0 when reaching the limit." I've never used this option, but looks like a potential basis for an answer. – user4556274 Dec 06 '17 at 13:39