How to rotate tcpdump captured files such that multiple small dump files will get saved instead of single large file ?
Issue
- Sometime the problem which needs to be debug using packet capture/tcpdump cannot be reprodued on will. Having tcpdump running for some long time till the problem happens again will create the capture file/
.pcapfile of several MiB/GiB, which will really be hard to open and handle in Wireshark. - So to tackle this sitution, how to do packet capture by tcpdump such that the dump files will get rotate and multiple small dump files will get saved instead of single large file till the problem happens ?
Environment
- Red Hat Enterprise Linux 4
- Red Hat Enterprise Linux 5
- Red Hat Enterprise Linux 6
- tcpdump
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase of over 48,000 articles and solutions.
Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.
