Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

How can I capture the last N seconds of packets using tcpdump?

share|improve this question

migrated from stackoverflow.com Jun 15 '11 at 12:41

This question came from our site for professional and enthusiast programmers.

1  
"Give me" will not take you far here. Maybe you should show us what you have tried so far and where exactly you have problems you can not solve yourself. –  matthias krull Jun 15 '11 at 13:27
    
The bash command you want is: "man tcpdump" –  William Pursell Jun 15 '11 at 18:00
add comment

2 Answers

I think the best way to accomplish this is with tcpdump's -G flag, which, when used with -w, will save your dump to a new file every N seconds. For instance:

tcpdump -w outfile-%s -G 10

This will create a new file with the name of 'outfile-XXXX' (where XXXX represents the number of seconds since epoch) every 10 seconds.

See the man pages for tcpdump(8) and strftime(3) for additional details.

share|improve this answer
    
tcpdump 3.9.4 as shipped with CentOS 5.10 does not have the -G option. I really need to upgrade my OS. –  Mister_Tom Jul 2 at 19:53
add comment

If you just want tcpdump to run for n seconds and then quit, you could use timeout.

For example:

timeout 2 tcpdump -eni mon0

Otherwise I don't believe tcpdump has an option to do this.

share|improve this answer
    
Unfortunately the timeout command is not present in CentOS 5.x. It was added in a newer release of coreutils. Another motivation for me to upgrade the OS. –  Mister_Tom Jul 2 at 19:52
    
I suppose if you don't have timeout, you could instead create something like timeout with a script: –  siesta Jul 3 at 20:47
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.