no more tcpdump in file with -w

[Catalin_Ciubot2]

Hello,

I used to save the tcpdump in a file with the command below

g_tcpdump -nni <interface> host <x> and host <y> -s 65535 -w /var/tmp/file

This was before applying take 113 to R81.20

Now I see that is not exporting anymore the packets but when I ran

g_tcpdump -nni <interface> host <x> and host <y> -s 65535

I see the packets on console.

I don't see the problem here, could you help?

Thanks!

[Lesley]

[Expert@SG-s01-01:0]# gclish

[Global] SG-s01-01 > tcpdump -mcap -w /tmp/capture.cap

Capturing packets...

Write "stop" and press enter to stop the packets capture process.

1_01:

tcpdump: listening on eth1-Mgmt4, link-type EN10MB (Ethernet), capture size 96 bytes

Clarification about this output:
At this moment, an administrator pressed the CTRL+C keys

stop

Received user request to stop the packets capture process.

Copying captured packets from all SGMs...

Merging captured packets from SGMs to /tmp/capture.cap...

Done.

[Global] SG-s01-01>

[Catalin_Ciubot2]

Thanks, but I have to capture on a specific interface with a filter, to avoid too many packets, and maybe performance load.

[Lesley]

add -i flag all tcpdump Linux flags work here

[Catalin_Ciubot2]

Once I add

-w /var/tmp/file

to the command, is creating an empty file 1 KB.

I repeat, without sending the output to file, the command is working.

For me this looks like another bug.

[Lesley]

MyChassis-ch01-01 > tcpdump -mcap -w /tmp/capture.cap -nnni eth1-Mgmt4

[the_rock]

Worked fine for me last time I tried on R81.20 and R82.

[emmap]

Check on all your SGMs for the /var/tmp/file output file. 

[Catalin_Ciubot2]

We are using SMO (Single Management Object). I'm pretty sure that I was using that syntax, I mentioned previously.

Now, I discover that is the one below.

g_tcpdump -mcap -w /var/tmp/testp.pcap -nni bond1.200 host x and host y

Why syntax changed?

[emmap]

As far as I am aware it's always needed the mcap flag to merge the output files. It's in the R80.20SP admin guide at least.

[Hauke]

Same issue!