Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I capture the last N seconds of packets using tcpdump?

share|improve this question

migrated from Jun 15 '11 at 12:41

This question came from our site for professional and enthusiast programmers.

"Give me" will not take you far here. Maybe you should show us what you have tried so far and where exactly you have problems you can not solve yourself. – matthias krull Jun 15 '11 at 13:27
The bash command you want is: "man tcpdump" – William Pursell Jun 15 '11 at 18:00

If you just want tcpdump to run for n seconds and then quit, you could use timeout.

For example:

timeout 2 tcpdump -eni mon0

Otherwise I don't believe tcpdump has an option to do this.

share|improve this answer
Unfortunately the timeout command is not present in CentOS 5.x. It was added in a newer release of coreutils. Another motivation for me to upgrade the OS. – Mister_Tom Jul 2 '14 at 19:52
I suppose if you don't have timeout, you could instead create something like timeout with a script: – siesta Jul 3 '14 at 20:47
Works great for me. I used this to monitor all traffic for a program that wasn't working. I started tcpdump with a timeout of N seconds. Then I started the program (which takes up to N seconds). – Trevor Boyd Smith Nov 18 '14 at 14:01

I think the best way to accomplish this is with tcpdump's -G flag, which, when used with -w, will save your dump to a new file every N seconds. For instance:

tcpdump -w outfile-%s -G 10

This will create a new file with the name of 'outfile-XXXX' (where XXXX represents the number of seconds since epoch) every 10 seconds.

See the man pages for tcpdump(8) and strftime(3) for additional details.

share|improve this answer
tcpdump 3.9.4 as shipped with CentOS 5.10 does not have the -G option. I really need to upgrade my OS. – Mister_Tom Jul 2 '14 at 19:53

tcpdump options -w new.tcpdump

ps -ef |grep tcpdump

take note of PID, say it is 11193

at 11:00 kill 11193

now just wait til 11:00 comes and your capture will be killed but saved

share|improve this answer
fwiw pgrep is a much better alternative to ps|grep; especially here. – Good Person Oct 28 '15 at 18:08

You can use tethereal instead of tcpdump. You can use this command-line option:

-a duration:X
share|improve this answer
While this may answer the question, it would be a better answer if you could provide some explanation why it does so. – DavidPostill Dec 17 '14 at 17:23
This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post - you can always comment on your own posts, and once you have sufficient reputation you will be able to comment on any post. – DavidPostill Dec 17 '14 at 17:23
While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. – suspectus Dec 17 '14 at 17:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.