[tcpdump-workers] [tcpdump] New feature to limit capture file size (#464)

Michael Richardson mcr at sandelman.ca
Tue Jun 9 15:42:47 EDT 2015


re: https://github.com/the-tcpdump-group/tcpdump/pull/464

Guy writes:
> We have the -C option, giving a file size in megabytes (real megabytes,
> i.e. 1,000,000 bytes, not 1,048,576 bytes); once the file gets that big,
> tcpdump switches to a new file.

> This adds another file size option, with a different syntax for the size
> option, and with tcpdump stopping rather than rotating files when it
> reaches that size.

> We also have the -G option, to rotate files based on time rather than size.

> We might want to consider cleaning up these options a bit, so that we can
> specify "stop" vs. "rotate" and "file size" rather than "capture time"
> independently.

thoughts?  I'm happy to accept the patch once sane, and then clean it up
as Guy suggests.






More information about the tcpdump-workers mailing list