tcpdump -C option, pilot error or genuine bug?
Trond Endrestøl
Trond.Endrestol at fagskolen.gjovik.no
Mon Apr 13 07:20:44 UTC 2015
Hi,
I'm attempting to run:
tcpdump -C 100 -U -i re0 -s 0 -v -w some-dump-file
on stable/10 r281235, the 20150407 amd64 snapshot.
The re0 interface is in monitor and permanent promiscuous mode,
i.e. ifconfig_re0="up monitor promisc".
I'm expecting to see files named:
some-dump-file
some-dump-file1
some-dump-file2
some-dump-file3
some-dump-file4
...
each file about 100 MB large, i.e. ~100,000,000 bytes.
I only see the some-dump-file, and it has now reached 15 GB.
As a contrast, the -G option expects the -w argument to contain
strftime(3) time formatting to enable timestamping of each file. The
-C option has no such requirement documented.
Is this a pilot error or a genuine bug?
I could switch to using:
-G 3600 -w 'some-dump-file-%Y-%m-%dT%H-%M-%s.pcap'
but I want a fixed file size more than a fixed time interval for each
file.
Any thoughts?
--
+-------------------------------+------------------------------------+
| Vennlig hilsen, | Best regards, |
| Trond Endrestøl, | Trond Endrestøl, |
| IT-ansvarlig, | System administrator, |
| Fagskolen Innlandet, | Gjøvik Technical College, Norway, |
| tlf. mob. 952 62 567, | Cellular...: +47 952 62 567, |
| sentralbord 61 14 54 00. | Switchboard: +47 61 14 54 00. |
+-------------------------------+------------------------------------+
More information about the freebsd-questions
mailing list