Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

How can I capture the last N seconds of packets using tcpdump?

share|improve this question

migrated from stackoverflow.com Jun 15 '11 at 12:41

This question came from our site for professional and enthusiast programmers.

1  
"Give me" will not take you far here. Maybe you should show us what you have tried so far and where exactly you have problems you can not solve yourself. –  matthias krull Jun 15 '11 at 13:27
    
The bash command you want is: "man tcpdump" –  William Pursell Jun 15 '11 at 18:00

3 Answers 3

You can use tethereal instead of tcpdump. You can use this command-line option:

-a duration:X
share|improve this answer
    
While this may answer the question, it would be a better answer if you could provide some explanation why it does so. –  DavidPostill Dec 17 at 17:23
    
This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post - you can always comment on your own posts, and once you have sufficient reputation you will be able to comment on any post. –  DavidPostill Dec 17 at 17:23
    
While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. –  suspectus Dec 17 at 17:54

If you just want tcpdump to run for n seconds and then quit, you could use timeout.

For example:

timeout 2 tcpdump -eni mon0

Otherwise I don't believe tcpdump has an option to do this.

share|improve this answer
    
Unfortunately the timeout command is not present in CentOS 5.x. It was added in a newer release of coreutils. Another motivation for me to upgrade the OS. –  Mister_Tom Jul 2 at 19:52
    
I suppose if you don't have timeout, you could instead create something like timeout with a script: –  siesta Jul 3 at 20:47
    
Works great for me. I used this to monitor all traffic for a program that wasn't working. I started tcpdump with a timeout of N seconds. Then I started the program (which takes up to N seconds). –  Trevor Boyd Smith Nov 18 at 14:01

I think the best way to accomplish this is with tcpdump's -G flag, which, when used with -w, will save your dump to a new file every N seconds. For instance:

tcpdump -w outfile-%s -G 10

This will create a new file with the name of 'outfile-XXXX' (where XXXX represents the number of seconds since epoch) every 10 seconds.

See the man pages for tcpdump(8) and strftime(3) for additional details.

share|improve this answer
    
tcpdump 3.9.4 as shipped with CentOS 5.10 does not have the -G option. I really need to upgrade my OS. –  Mister_Tom Jul 2 at 19:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.