tcpdump -C option, pilot error or genuine bug?

Trond Endrestøl Trond.Endrestol at fagskolen.gjovik.no
Mon Apr 13 07:20:44 UTC 2015


Hi,

I'm attempting to run:

tcpdump -C 100 -U -i re0 -s 0 -v -w some-dump-file

on stable/10 r281235, the 20150407 amd64 snapshot.

The re0 interface is in monitor and permanent promiscuous mode, 
i.e. ifconfig_re0="up monitor promisc".

I'm expecting to see files named:

some-dump-file
some-dump-file1
some-dump-file2
some-dump-file3
some-dump-file4
...

each file about 100 MB large, i.e. ~100,000,000 bytes.

I only see the some-dump-file, and it has now reached 15 GB.

As a contrast, the -G option expects the -w argument to contain 
strftime(3) time formatting to enable timestamping of each file. The 
-C option has no such requirement documented.

Is this a pilot error or a genuine bug?

I could switch to using:

-G 3600 -w 'some-dump-file-%Y-%m-%dT%H-%M-%s.pcap'

but I want a fixed file size more than a fixed time interval for each 
file.

Any thoughts?

-- 
+-------------------------------+------------------------------------+
| Vennlig hilsen,               | Best regards,                      |
| Trond Endrestøl,              | Trond Endrestøl,                   |
| IT-ansvarlig,                 | System administrator,              |
| Fagskolen Innlandet,          | Gjøvik Technical College, Norway,  |
| tlf. mob.   952 62 567,       | Cellular...: +47 952 62 567,       |
| sentralbord 61 14 54 00.      | Switchboard: +47 61 14 54 00.      |
+-------------------------------+------------------------------------+


More information about the freebsd-questions mailing list