I'm trying to capture all my networking with tcpdump.

I'm using tcpdump.exe -i {} -W 5 -C 10 -w capfile. After 10 mints (+-) the capture stopped for some reason, and tcpdump is still running.

Maybe there is a parameter for how much time to capture? I Know the -G parameter, but it's rotate the pcap files.

If someone know why it's happened and how can I fix that, to capture for unlimited time I will be grateful :)

I'm using tcpdump.exe on windows.

By the way, there is any way to use -i "eth0" on windows? Because on windows I need to check my interface number and use it like this -i "3".



-C 10 limits the size of the file to 10 MB.
After the first capfile file is full, numbered capfile files will be added.

-W 5 limits the number of these files to 5, after which it begins overwriting files from the beginning as a rotating buffer.

I believe tcpdump is still working, busily overwriting its five "capfile` files.

See : Manpage of TCPDUMP.

  • I know the parameters. – John B. Burns Jul 11 '18 at 6:57
  • I know the parameters. But the capfile doesn't change, it's doesn't overwriting the five file, it's just stop the capture, I saw the five "capfile" but after few mints the file doesn't change any more, The "Date modified" doesn't change any more. – John B. Burns Jul 11 '18 at 7:08
  • I suggest that you copy the 5 files, wait an hour, then compare the contents to see if it is really hang. If instead of rotation it stops, then this is a bug. I don't exactly know where you may report it, perhaps at tcpdump.org. In the meantime, you may avoid circular buffers if that is indeed the buggy feature. – harrymc Jul 11 '18 at 8:28

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.