Ring buffer capture by size

Rotate across 5 files of 100MB each so long captures never fill the disk

tcpdump -nn -i any -s 0 -C 100 -W 5 -w /tmp/cap.pcap
tool
tcpdump18 commands
tags
tcpdumpdiskmonitoringnetwork

More tcpdump commands

  • Time-rotated capture files
    tcpdump -nn -i any -G 3600 -w '/tmp/cap-%Y%m%d-%H%M%S.pcap'

    Start a fresh pcap every hour with a timestamped name for unattended capture

  • Filter an existing pcap offline
    tcpdump -nn -r /tmp/cap.pcap 'port 443 and host <ip>'

    Re-filter a saved capture without re-running it; BPF applies on read

  • DNS query capture with link header
    tcpdump -nn -e -i any port 53

    Show DNS lookups with MAC addresses (-e) to map queries to clients on the LAN

  • Capture on interface
    tcpdump -i eth0 -n

    Capture all traffic on eth0 without DNS resolution

  • Capture to file
    tcpdump -i eth0 -w /tmp/capture.pcap

    Save raw packets to PCAP file for Wireshark analysis

all 18 tcpdump commands