How can I capture the last N seconds of packets using tcpdump?
Tell me more
×
Super User is a question and answer site for
computer enthusiasts and power users. It's 100% free, no registration required.
|
migrated from stackoverflow.com Jun 15 '11 at 12:41
|
I think the best way to accomplish this is with tcpdump's -G flag, which, when used with -w, will save your dump to a new file every N seconds. For instance: tcpdump -w outfile-%s -G 10 This will create a new file with the name of 'outfile-XXXX' (where XXXX represents the number of seconds since epoch) every 10 seconds. See the man pages for tcpdump(8) and strftime(3) for additional details. |
|||
|
|
