I have some SLES 12.2 server where I need to monitor certain network traffic for diagnosing a problem that occurs every now an then. I'll try to record the traffic with tcpdump, and when that problem arises, I could dissect the correcponding network traffic with Wireshark.
I've set up a main script which contains
tcpdump -iany -G $((30*60)) -n -w tcpdump.io.%F_%H%M%S.pcap -z ./tcpdump_postproc.sh net 192.168.1.0/24 or net 192.168.2.0/24 > tcpdump.statistics
and a helper script tcpdump_postproc.sh
for some postprocessing:
find . -maxdepth 0 -mmin +$((12*60)) -name '*.pcap.gz' -delete
I'd expect that script to run indefinitely, creating capture files containing 30 minutes of data each, until I stop tcpdump with i.e. [CTRL-C] or kill
. The postprocessing called after stopping (and whenever a new capture file is created) will zip the created capture files and limit the backlog of capture files to 12 hours.
So far, so good. Now to the problem:
tcpdump stops capturing data in the middle of the second file and exits (without error, as far as I could see).
What have I missed ?