[SOLVED] how to limit the tcpdump command to a time interval

omega341991 · 05-17-2012, 04:18 AM

i would like to know how to limit the duration of packet capture using tcpdump. For Eg.capturing data for 10 seconds using tcpdump

pan64 · 05-17-2012, 05:35 AM

it looks you need to use another tool and stop tcpdump.
there is a coreutils package and it contains a timeout command.
http://www.gnu.org/software/coreutils/
http://www.gnu.org/software/coreutil...out-invocation

unSpawn · 05-17-2012, 05:51 AM

For systems w/o 'timeout', and unless you know what traffic rate you have (check 'man tcpdump' for capture size), here's another easy way:

Code:

/path/to/tcpdumpbinary --whatever-args-you-need &
sleep 10s && pkill -HUP -f /path/to/tcpdumpbinary

* If you aim for longer capture durations there's also the 'at' service:

Code:

echo "/path/to/tcpdumpbinary --whatever-args-you-need"|/usr/bin/at now
echo "pkill -HUP -f /path/to/tcpdumpbinary"|/usr/bin/at now +30 minutes

omega341991 · 05-17-2012, 05:59 AM

thanks a lot pan64

its works like a charm