1

I'm trying to capture all my networking with tcpdump.

I'm using tcpdump.exe -i {} -W 5 -C 10 -w capfile. After 10 mints (+-) the capture stopped for some reason, and tcpdump is still running.

Maybe there is a parameter for how much time to capture? I Know the -G parameter, but it's rotate the pcap files.

If someone know why it's happened and how can I fix that, to capture for unlimited time I will be grateful :)

I'm using tcpdump.exe on windows.

By the way, there is any way to use -i "eth0" on windows? Because on windows I need to check my interface number and use it like this -i "3".

Thanks.

1 Answer 1

0

-C 10 limits the size of the file to 10 MB.
After the first capfile file is full, numbered capfile files will be added.

-W 5 limits the number of these files to 5, after which it begins overwriting files from the beginning as a rotating buffer.

I believe tcpdump is still working, busily overwriting its five "capfile` files.

See : Manpage of TCPDUMP.

3
  • I know the parameters. Commented Jul 11, 2018 at 6:57
  • I know the parameters. But the capfile doesn't change, it's doesn't overwriting the five file, it's just stop the capture, I saw the five "capfile" but after few mints the file doesn't change any more, The "Date modified" doesn't change any more. Commented Jul 11, 2018 at 7:08
  • I suggest that you copy the 5 files, wait an hour, then compare the contents to see if it is really hang. If instead of rotation it stops, then this is a bug. I don't exactly know where you may report it, perhaps at tcpdump.org. In the meantime, you may avoid circular buffers if that is indeed the buggy feature.
    – harrymc
    Commented Jul 11, 2018 at 8:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .