How can I capture the last N seconds of packets using tcpdump?
migrated from stackoverflow.com Jun 15 '11 at 12:41
This question came from our site for professional and enthusiast programmers.
I think the best way to accomplish this is with tcpdump's -G flag, which, when used with -w, will save your dump to a new file every N seconds. For instance:
tcpdump -w outfile-%s -G 10
This will create a new file with the name of 'outfile-XXXX' (where XXXX represents the number of seconds since epoch) every 10 seconds.
See the man pages for tcpdump(8) and strftime(3) for additional details.
If you just want tcpdump to run for n seconds and then quit, you could use timeout.
Otherwise I don't believe tcpdump has an option to do this.