Create a Post
Showing results for 
Search instead for 
Did you mean: 
Jump to solution

Cppcap - exit after X files?


While troubleshooting an issue for a customer I had to collect a bunch of traffic and I tried to use cppcap but have a few questions that I just want check if anyone else has seen and solved somehow.

The issue I was troubleshooting required me to collect traffic over a long period. While setting up the capture I was looking for a way to automatically exit after having saved X amount of data. As far as I could see, the only option was 

-b <NUM>capture NUM bytes before stopping

but to the best of my understanding this is a counter of collected data on the wire, not amount of data saved to a file...

Has anyone found a way of collecting (for example) 10 files, each 1GB large and then exit?

-w <FMT>file size limit with rotation followed by 'K'ilo,'M'ega or 'G'iga. Default is bytes
-W <NUM>use up to NUM files with rotation (use with '-w') 

-w and -W will limit size and number of files but it will rotate forever and not exit after reaching the value of -W.

Also, if using -I to capture on multiple interfaces, is there afterwards any reference to the interface on which the packet was captured?





0 Kudos
8 Replies
This widget could not be displayed.


Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events