Issue with TCPdump

[Dan Mahoney]

Hey all,

Here at ISC, we're seeing a weird issue with the tcpdump command in 
10.0-RELEASE.  I'm hoping someone can take a look. 
-- 

We have an F-root stats collector that we run as part of an annual event 
to gather data across various root servers.  It uses the following tcpdump 
syntax:

/usr/sbin/tcpdump -i em0 -G 600 -s 0 -w 
/var/tcpdumps/cdg1b-pcap.%Y-%m-%d-%H:%M:%S -z gzip dst net ( 
192.5.5.241/32 or 2001:500:2f::f/128) and not ( src net 204.152.184.0/21 
or src net 149.20.0.0/16 or src net 2001:04F8::/32 and dst port 22 )

I've included the full command in case it's needed, but the only bits we 
really care about are -G 600 and -z gzip, which should gzip all the log 
files, right out of the manpage.

What this SHOULD give us is a bunch of gzipped files in /var/tcpdumps.  In 
reality, only the first file is gzipped:

root at cdg1b:/var/tcpdumps # ls -al
total 66888
drwxr-xr-x   2 root  wheel     1024 Apr  6 08:07 .
drwxr-xr-x  32 root  wheel     1024 Nov  3 10:30 ..
-rw-r--r--   1 root  wheel  1762188 Apr  6 04:44 
cdg1b-pcap.2015-04-06-04:34:47.gz
-rw-r--r--   1 root  wheel  5262738 Apr  6 04:54 
cdg1b-pcap.2015-04-06-04:44:47
-rw-r--r--   1 root  wheel  5371252 Apr  6 05:04 
cdg1b-pcap.2015-04-06-04:54:47
-rw-r--r--   1 root  wheel  5828832 Apr  6 05:14 
cdg1b-pcap.2015-04-06-05:04:47
-rw-r--r--   1 root  wheel  5612538 Apr  6 05:24 
cdg1b-pcap.2015-04-06-05:14:47
-rw-r--r--   1 root  wheel  5864548 Apr  6 05:34 
cdg1b-pcap.2015-04-06-05:24:47
-rw-r--r--   1 root  wheel  5728222 Apr  6 05:44 
cdg1b-pcap.2015-04-06-05:34:47
-rw-r--r--   1 root  wheel  5749591 Apr  6 05:54 
cdg1b-pcap.2015-04-06-05:44:47
-rw-r--r--   1 root  wheel  5845820 Apr  6 06:04 
cdg1b-pcap.2015-04-06-05:54:47
-rw-r--r--   1 root  wheel  5874731 Apr  6 06:14 
cdg1b-pcap.2015-04-06-06:04:47
-rw-r--r--   1 root  wheel  5689875 Apr  6 06:24 
cdg1b-pcap.2015-04-06-06:14:47
-rw-r--r--   1 root  wheel  5592813 Apr  6 06:34 
cdg1b-pcap.2015-04-06-06:24:47

Sorry for the messy output.  I'd happily log this as a bug (either in 
FreeBSD, or upstream) if someone else 
could take a look.

-Dan