Gingercat1.png Welcome to...
GingerCat Software
We make software for the Web the Macintosh and linux
(among other things!) We hope you enjoy our site

Blog | New Site
Tcpdump file rotation and management

Wireshark has the ability to rotate and generate specific sized packet captures. All of this is very easily achieved via the GUI.

Tcpdump also has this ability but it's not that well documented.

The following will write a 1 Mb dumpfile and create additional files as the 1 megabyte level is reached.

sudo tcpdump -C 1 -s 0 -w dumpfile

This version of the command will write 3, 1MB size dump files and keep writing over the 3 files sequentially thus limiting the amount of data captured (and not filling up your hard drive and killing your machine!)

sudo tcpdump -C 1 -W 3 -s 0 -w dumpfile

*disclaimer!

Packet sniffing (looking at live or pre captured network traffic) is a fascinating process to be involved in BUT!! This article and implementing the information in it could lose you your job, get you arrested or have your ISP terminate your account or worse!

Don't sniff the network packets at work or on any network without some form of written permission and may be even have this relate to a company policy.Be aware of the issues involved. YOU HAVE BEEN WARNED




© 2006 Steve Abrahall