hi..i'm using tcpdump to capture my network traffic..When it reached the specified limit, it will automatically created a new file. The problem is i got this error when issue this command :

Command
Error
Question

1- I got this command from network security book. Not really understand the command. What is %INT and $filesize used for? Is it variables that we have to declare ?

2- Using google, i found that "tcpdump: SIOCGIFHWADDR: No such device" is network card driver problem.Is it true?

3- How to solve this problem?

Thanks

1. Read the man page for tcpdump. It will explain what -i and -C are.

The %INT is a typo on your part. You meant $INT. These are shell variables. Use the name of your interface and the file size you want instead. You don't need the variables, the book probably used them since these values would be different for various systems (for $INT, the network interface) and file size (select your own choice of $filesize).

2. This will be resolve itself when you use the correct network interface name (eg. eth0).

3. Go back to step 1.

$INT and $filesize are variables containing the interface and filesize to use. You do need to give them values first, with something like

INT=eth0
filesize=1 (for a file size of 1 million bytes, as per the tcpdump man page)

and then run tcpdump, giving those variables. The error message you get should be taken literally: the device you're telling it to capture from doesn't exist. Check that you're passing the correct device. A simple way to check which devices exist would be to run ifconfig.

I issuing this command :

I got this error :

The quotes around your date command should be backquotes `date...`. The .pcap should be immediately adjacent to the backquotes if you want to concatenate the file name with the suffix .pcap (eg. -w /home/apit/capture-`date +%Y%M%d-%H%M%s`.pcap - there should be no space before .pcap.

Use the $(cmd) syntax instead here - it is cleaner looking and more obvious:

/home/apit/capture-$(date +%Y%M%d-%H%M%s).pcap

Thanks a lot Nylex & Mr.C
I do both of the option and it running ok

Option 1
Option 2