LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Software (https://www.linuxquestions.org/questions/linux-software-2/)
-   -   tcpdump 4.1.1 with libpcap 1.1.1 will not work with -C and -G options simultaneously (https://www.linuxquestions.org/questions/linux-software-2/tcpdump-4-1-1-with-libpcap-1-1-1-will-not-work-with-c-and-g-options-simultaneously-4175476786/)

Omacron 09-11-2013 05:26 PM

tcpdump 4.1.1 with libpcap 1.1.1 will not work with -C and -G options simultaneously
 
Hi all,
I am having some problems getting tcpdump 4.1.1 to behave as needed. My objective is:
-Generate a new pcapfile every hour (with time and date in capture name)
-If any capture during this hour period is greater than 50 MB then generate a new file with the same name and a numerical suffix at the end.

In tcpdump 4.4.0 (libpcap 1.4.0) this is possible via the following command:
tcpdump -pni eth0 -s65535 -G 3600 -C 50 -w 'trace_%Y-%m-%d_%H:%M:%S.pcap'
This will generate a set of logs as so: (I would rather the counter restarted to 1 every time a new logfile has been split, but I can live with this for the moment)
trace_2013-09-11_22:42:38.pcap
trace_2013-09-11_22:42:38.pcap1
trace_2013-09-11_22:42:38.pcap2
trace_2013-09-11_22:42:38.pcap3
trace_2013-09-11_22:42:38.pcap4
trace_2013-09-11_22:42:38.pcap5
trace_2013-09-11_22:42:38.pcap6
trace_2013-09-11_22:43:08.pcap
trace_2013-09-11_22:43:08.pcap7
trace_2013-09-11_22:43:08.pcap8
trace_2013-09-11_22:43:08.pcap9
trace_2013-09-11_22:43:08.pcap10
trace_2013-09-11_22:43:08.pcap11
trace_2013-09-11_22:43:38.pcap
trace_2013-09-11_22:44:08.pcap

However with tcpdump 4.1.1 the -C option seems to be ignored, and tcpdump just rotates the logfiles without splitting them into smaller ones.

The production machine I need to install this on is running a customized version of debian squeeze which offers tcpdump 4.1.1 as the latest version in repos. libpcap is being used by other packages on the system so I really cannot update the dependencies needed to compile the latest version of tcpdump without updating the other packages too.
Is there a way to get this working with tcpdump 4.1.1 or compile tcpdump to use a localized and seperate version of libpcap and other needed libs that will not interfere with other applications?
I have tried compiling libpcap but it needs the latest version of flex which in turn needs the latest version of m4 ...

Any help and suggestions are very much appreciated.
Cheers


All times are GMT -5. The time now is 05:48 AM.