While troubleshooting an issue for a customer I had to collect a bunch of traffic and I tried to use cppcap but have a few questions that I just want check if anyone else has seen and solved somehow.
The issue I was troubleshooting required me to collect traffic over a long period. While setting up the capture I was looking for a way to automatically exit after having saved X amount of data. As far as I could see, the only option was
|-b <NUM>||capture NUM bytes before stopping|
but to the best of my understanding this is a counter of collected data on the wire, not amount of data saved to a file...
Has anyone found a way of collecting (for example) 10 files, each 1GB large and then exit?
|-w <FMT>||file size limit with rotation followed by 'K'ilo,'M'ega or 'G'iga. Default is bytes|
|-W <NUM>||use up to NUM files with rotation (use with '-w') |
-w and -W will limit size and number of files but it will rotate forever and not exit after reaching the value of -W.
Also, if using -I to capture on multiple interfaces, is there afterwards any reference to the interface on which the packet was captured?