1

I'm trying to capture all my networking with tcpdump.

I'm using tcpdump.exe -i {} -W 5 -C 10 -w capfile. After 10 mints (+-) the capture stopped for some reason, and tcpdump is still running.

Maybe there is a parameter for how much time to capture? I Know the -G parameter, but it's rotate the pcap files.

If someone know why it's happened and how can I fix that, to capture for unlimited time I will be grateful :)

I'm using tcpdump.exe on windows.

By the way, there is any way to use -i "eth0" on windows? Because on windows I need to check my interface number and use it like this -i "3".

Thanks.

0

-C 10 limits the size of the file to 10 MB.
After the first capfile file is full, numbered capfile files will be added.

-W 5 limits the number of these files to 5, after which it begins overwriting files from the beginning as a rotating buffer.

I believe tcpdump is still working, busily overwriting its five "capfile` files.

See : Manpage of TCPDUMP.

3
  • I know the parameters. Jul 11 '18 at 6:57
  • I know the parameters. But the capfile doesn't change, it's doesn't overwriting the five file, it's just stop the capture, I saw the five "capfile" but after few mints the file doesn't change any more, The "Date modified" doesn't change any more. Jul 11 '18 at 7:08
  • I suggest that you copy the 5 files, wait an hour, then compare the contents to see if it is really hang. If instead of rotation it stops, then this is a bug. I don't exactly know where you may report it, perhaps at tcpdump.org. In the meantime, you may avoid circular buffers if that is indeed the buggy feature.
    – harrymc
    Jul 11 '18 at 8:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.