dacaprice.com from fitness to technology. mostly technology. sometimes fitness.

Rotating files with tcpdump

tcpdump -s 0 port 80 -C 10 -w /tmp/capture.pcap

The above command captures complete packets (-s 0) and writes them to /tmp/capture.pcap.  The -C 10 tells tcpdump to rotate the .pcap files out when they reach 10MB in size.  So capture.pcap would be the original, followed by capture.pcap1, capture.pcap2, etc.

One important note:  tcpdump drops permissions when you use the -C, so make sure you write to a directory that is world-writable.