tcpdump -w not writing data

greyarea · 10-18-2010, 03:59 PM

Hi

I'm trying to capture packets to a file with the -w option but the file is empty yet if I use the '-w -' option to put data on stdout I see plenty of captured packets.

I'm using CentOS 5.5 x86

Code:

[root@server ~]# tcpdump -v -i eth0 -w dump -s0
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
718 packets captured
718 packets received by filter
0 packets dropped by kernel
[root@server ~]# file dump
dump: empty

Any ideas why the file is empty?

Ta,

rweaver · 10-18-2010, 04:16 PM

Is the drive full and do you have write permissions to the directory (check chattr for special perms also)? Also see if it writes them to screen if you use a -w -

greyarea · 10-18-2010, 04:35 PM

I can create files in root's home directory without a problem, plenty of space on the slice. And yes, as I said if I do -w - I see plenty of data scrolling up the screen.

The network card is a VMware vmxnet adapter on a VM so I was wondering if the vswitch was blocking promiscuous mode but even -p gives the same problem so I may be confusing the issue.