Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

How can I capture the last N seconds of packets using tcpdump?

share|improve this question

migrated from stackoverflow.com Jun 15 '11 at 12:41

This question came from our site for professional and enthusiast programmers.

"Give me" will not take you far here. Maybe you should show us what you have tried so far and where exactly you have problems you can not solve yourself. –  matthias krull Jun 15 '11 at 13:27
The bash command you want is: "man tcpdump" –  William Pursell Jun 15 '11 at 18:00

2 Answers 2

If you just want tcpdump to run for n seconds and then quit, you could use timeout.

For example:

timeout 2 tcpdump -eni mon0

Otherwise I don't believe tcpdump has an option to do this.

share|improve this answer
Unfortunately the timeout command is not present in CentOS 5.x. It was added in a newer release of coreutils. Another motivation for me to upgrade the OS. –  Mister_Tom Jul 2 at 19:52
I suppose if you don't have timeout, you could instead create something like timeout with a script: –  siesta Jul 3 at 20:47
Works great for me. I used this to monitor all traffic for a program that wasn't working. I started tcpdump with a timeout of N seconds. Then I started the program (which takes up to N seconds). –  Trevor Boyd Smith Nov 18 at 14:01

I think the best way to accomplish this is with tcpdump's -G flag, which, when used with -w, will save your dump to a new file every N seconds. For instance:

tcpdump -w outfile-%s -G 10

This will create a new file with the name of 'outfile-XXXX' (where XXXX represents the number of seconds since epoch) every 10 seconds.

See the man pages for tcpdump(8) and strftime(3) for additional details.

share|improve this answer
tcpdump 3.9.4 as shipped with CentOS 5.10 does not have the -G option. I really need to upgrade my OS. –  Mister_Tom Jul 2 at 19:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.