Date: Mon, 6 Apr 2015 08:22:52 +0000 (UTC) From: Dan Mahoney <dmahoney@isc.org> To: freebsd-net@freebsd.org Cc: plosher@isc.org Subject: Issue with TCPdump Message-ID: <alpine.BSF.2.11.1504060810540.28694@bikeshed.isc.org>
next in thread | raw e-mail | index | archive | help
Hey all, Here at ISC, we're seeing a weird issue with the tcpdump command in 10.0-RELEASE. I'm hoping someone can take a look. -- We have an F-root stats collector that we run as part of an annual event to gather data across various root servers. It uses the following tcpdump syntax: /usr/sbin/tcpdump -i em0 -G 600 -s 0 -w /var/tcpdumps/cdg1b-pcap.%Y-%m-%d-%H:%M:%S -z gzip dst net ( 192.5.5.241/32 or 2001:500:2f::f/128) and not ( src net 204.152.184.0/21 or src net 149.20.0.0/16 or src net 2001:04F8::/32 and dst port 22 ) I've included the full command in case it's needed, but the only bits we really care about are -G 600 and -z gzip, which should gzip all the log files, right out of the manpage. What this SHOULD give us is a bunch of gzipped files in /var/tcpdumps. In reality, only the first file is gzipped: root@cdg1b:/var/tcpdumps # ls -al total 66888 drwxr-xr-x 2 root wheel 1024 Apr 6 08:07 . drwxr-xr-x 32 root wheel 1024 Nov 3 10:30 .. -rw-r--r-- 1 root wheel 1762188 Apr 6 04:44 cdg1b-pcap.2015-04-06-04:34:47.gz -rw-r--r-- 1 root wheel 5262738 Apr 6 04:54 cdg1b-pcap.2015-04-06-04:44:47 -rw-r--r-- 1 root wheel 5371252 Apr 6 05:04 cdg1b-pcap.2015-04-06-04:54:47 -rw-r--r-- 1 root wheel 5828832 Apr 6 05:14 cdg1b-pcap.2015-04-06-05:04:47 -rw-r--r-- 1 root wheel 5612538 Apr 6 05:24 cdg1b-pcap.2015-04-06-05:14:47 -rw-r--r-- 1 root wheel 5864548 Apr 6 05:34 cdg1b-pcap.2015-04-06-05:24:47 -rw-r--r-- 1 root wheel 5728222 Apr 6 05:44 cdg1b-pcap.2015-04-06-05:34:47 -rw-r--r-- 1 root wheel 5749591 Apr 6 05:54 cdg1b-pcap.2015-04-06-05:44:47 -rw-r--r-- 1 root wheel 5845820 Apr 6 06:04 cdg1b-pcap.2015-04-06-05:54:47 -rw-r--r-- 1 root wheel 5874731 Apr 6 06:14 cdg1b-pcap.2015-04-06-06:04:47 -rw-r--r-- 1 root wheel 5689875 Apr 6 06:24 cdg1b-pcap.2015-04-06-06:14:47 -rw-r--r-- 1 root wheel 5592813 Apr 6 06:34 cdg1b-pcap.2015-04-06-06:24:47 Sorry for the messy output. I'd happily log this as a bug (either in FreeBSD, or upstream) if someone else could take a look. -Dan
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?alpine.BSF.2.11.1504060810540.28694>