Ring buffer capture by size tcpdump
Rotate across 5 files of 100MB each so long captures never fill the disk
tcpdump -nn -i any -s 0 -C 100 -W 5 -w /tmp/cap.pcap
more tcpdump
all 18 commands →
Time-rotated capture files
tcpdump -nn -i any -G 3600 -w '/tmp/cap-%Y%m%d-%H%M%S.pcap'
Filter an existing pcap offline
tcpdump -nn -r /tmp/cap.pcap 'port 443 and host <ip>'
DNS query capture with link header
tcpdump -nn -e -i any port 53
Capture on interface
tcpdump -i eth0 -n
Capture to file
tcpdump -i eth0 -w /tmp/capture.pcap