From owner-freebsd-questions@FreeBSD.ORG Sat May 23 18:29:36 2009 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 35DA81065677 for ; Sat, 23 May 2009 18:29:36 +0000 (UTC) (envelope-from m.seaman@infracaninophile.co.uk) Received: from smtp.infracaninophile.co.uk (gate6.infracaninophile.co.uk [IPv6:2001:8b0:151:1::1]) by mx1.freebsd.org (Postfix) with ESMTP id A7D8D8FC18 for ; Sat, 23 May 2009 18:29:35 +0000 (UTC) (envelope-from m.seaman@infracaninophile.co.uk) Received: from happy-idiot-talk.infracaninophile.co.uk (localhost [IPv6:::1]) (authenticated bits=0) by smtp.infracaninophile.co.uk (8.14.3/8.14.3) with ESMTP id n4NITRnH046160; Sat, 23 May 2009 19:29:28 +0100 (BST) (envelope-from m.seaman@infracaninophile.co.uk) X-DKIM: Sendmail DKIM Filter v2.8.2 smtp.infracaninophile.co.uk n4NITRnH046160 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=infracaninophile.co.uk; s=200708; t=1243103369; bh=TEhbFONXixWVCSQRsuJy2ITRg7M7SgsqBxWjvvP+O4o=; h=Message-ID:Date:From:MIME-Version:To:CC:Subject:References: In-Reply-To:Content-Type:Cc:Content-Type:Date:From:In-Reply-To: Message-ID:Mime-Version:References:To; z=Message-ID:=20<4A184080.7010203@infracaninophile.co.uk>|Date:=20S at,=2023=20May=202009=2019:29:20=20+0100|From:=20Matthew=20Seaman= 20|Organization:=20Infracaninophi le|User-Agent:=20Thunderbird=202.0.0.21=20(X11/20090420)|MIME-Vers ion:=201.0|To:=20=3D?ISO-8859-1?Q?Morgan_Wesstr=3DF6m?=3D=20|CC:=20freebsd-questions@freebsd.org|Su bject:=20Re:=20how=20to=20rotate=20a=20tcpdump=20file|References:= 20<852FCD4FD0834115930F3DB05ADB7F3C@desktop2002>=09<20090523160452 .GA71919@melon.esperance-linux.co.uk>=20<4A1831CD.6080505@pp.dyndn s.biz>|In-Reply-To:=20<4A1831CD.6080505@pp.dyndns.biz>|X-Enigmail- Version:=200.95.6|Content-Type:=20multipart/signed=3B=20micalg=3Dp gp-sha256=3B=0D=0A=20protocol=3D"application/pgp-signature"=3B=0D= 0A=20boundary=3D"------------enigCC1D7ADFD24C9BB2D25F1B1D"; b=WyzWxWgW9FsvbQnV2JUVZxObI6aO7mD9Hc4+KZM+UMAxOWg+OYayFYzJwNXt29gZO lcQyUnHheaBvFCtG8VYv4GX5X+3FQgEByTvoVnG6Xk9rc9GpmIS0lx2kuiZ9Ty0xXo Z7n/uU4flF1Q9ZWF3CibuSmMP3QWxDcbqy3U9Gw8= X-Authentication-Warning: happy-idiot-talk.infracaninophile.co.uk: Host localhost [IPv6:::1] claimed to be happy-idiot-talk.infracaninophile.co.uk Message-ID: <4A184080.7010203@infracaninophile.co.uk> Date: Sat, 23 May 2009 19:29:20 +0100 From: Matthew Seaman Organization: Infracaninophile User-Agent: Thunderbird 2.0.0.21 (X11/20090420) MIME-Version: 1.0 To: =?ISO-8859-1?Q?Morgan_Wesstr=F6m?= References: <852FCD4FD0834115930F3DB05ADB7F3C@desktop2002> <20090523160452.GA71919@melon.esperance-linux.co.uk> <4A1831CD.6080505@pp.dyndns.biz> In-Reply-To: <4A1831CD.6080505@pp.dyndns.biz> X-Enigmail-Version: 0.95.6 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="------------enigCC1D7ADFD24C9BB2D25F1B1D" X-Virus-Scanned: clamav-milter 0.95.1 at happy-idiot-talk.infracaninophile.co.uk X-Virus-Status: Clean X-Spam-Status: No, score=-3.0 required=5.0 tests=AWL,BAYES_00,DKIM_SIGNED, DKIM_VERIFIED,NO_RELAYS autolearn=ham version=3.2.5 X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on happy-idiot-talk.infracaninophile.co.uk Cc: freebsd-questions@freebsd.org Subject: Re: how to rotate a tcpdump file X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 23 May 2009 18:29:36 -0000 This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --------------enigCC1D7ADFD24C9BB2D25F1B1D Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: quoted-printable Morgan Wesstr=F6m wrote: > Frank Shute wrote: >> On Sat, May 23, 2009 at 02:57:08PM +0300, Yavuz Ma?lak wrote: >>> I wish tcpdump to rotate tcpdump file whose size reaches 10Mbyte. >>> >>> Which command should I use ? >>> >> You should be able to set up newsyslog(8) to rotate the dumps. >> >> You want to have a look at newsyslog.conf(5) to craft a line to put in= >> your conf file. There are examples to work from in the conf file >> already. >> >> Regards, >=20 > Correct me if I'm wrong but wouldn't tcpdump have to be restarted after= > the logrotate? I'm under the impression that it would just continue to > output to the old inode even if the file occupying it changes name and > the restart functionality of newsyslog(8) isn't really bright enough to= > restart tcpdump with all its initial parameters. > I'm using sysutils/cronolog for my Apache logs so I don't have to > restart Apache at all for the logrotate. Unfortunately cronolog doesn't= > seem to have a size option to trigger the rotation though. Maybe there'= s > another alternative for the OP? tcpdump(1) doesn't have options to support rotating dump files based on size, and it doesn't understand SIGHUP to mean close all open file descriptors and reinitialise yourself the way that syslogd(8) and a lot of other daemon processes do, so newsyslog(8) won't work either. Therefore you're going to have to wrap tcpdump in a script to test the si= ze of the output file, stop tcpdump when the output hits the target size, th= en restart tcpdump with a new dump file. [If you're trying to dump very frequent traffic this will almost certainly mean that you miss a few= packets]. Now, depending on what data you're capturing there might be a really simp= le way of doing that. If you capture just the default 68 bytes of headers t= hen simply capturing 154202 packets will give you a 10MB dump file. So you c= an do this: #!/bin/sh n=3D0 while true ; do n=3D$(( $n + 1 )) tcpdump -i em0 -c 154202 -w /tmp/tcpdump.out.$n done On the other hand, if you want to capture the traffic in it's entirety (ie. by using '-s 0' on the tcpdump command line so you get the packet payload as well), then packets can be anywhere up to 1500bytes (on a typi= cal ethernet -- 8kB or more is possible if you're using jumbo frames). Packe= t counting won't work help in this case, but something like the following m= ight. (Warning: completely untested code. May cause unexpected results up to a= nd including the destruction of the Internet...) #!/bin/sh tcpdumpcmd=3D'tcpdump -i em0 -s 0 -w /tmp/tcpdump.out.$n &' n=3D0 while true ; do n=3D$(( $n++ )); eval $tcpdumpcmd while [ $( stat -f %z /tmp/tcpdump.$n ) -lt 10485760 ] ; do sleep 5; done kill $( jobs -s ) done Cheers, Matthew --=20 Dr Matthew J Seaman MA, D.Phil. 7 Priory Courtyard Flat 3 PGP: http://www.infracaninophile.co.uk/pgpkey Ramsgate Kent, CT11 9PW --------------enigCC1D7ADFD24C9BB2D25F1B1D Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.11 (FreeBSD) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEAREIAAYFAkoYQIcACgkQ8Mjk52CukIx/zwCdH5lCwBezKAQeHRehiGZX9b/j 0BMAnRnnKyYUwDD4lf/JEBSn+fwsFJ2L =0MZ2 -----END PGP SIGNATURE----- --------------enigCC1D7ADFD24C9BB2D25F1B1D--