Date: Mon, 6 Apr 2015 22:47:16 -0700 From: Kevin Oberman <rkoberman@gmail.com> To: Dan Mahoney <dmahoney@isc.org> Cc: "freebsd-net@freebsd.org" <freebsd-net@freebsd.org>, plosher@isc.org Subject: Re: Issue with TCPdump Message-ID: <CAN6yY1u_5KE0YK60DDxHMg_OMgxhsWe917P11h6_RMCVwV1BSQ@mail.gmail.com> In-Reply-To: <alpine.BSF.2.11.1504060810540.28694@bikeshed.isc.org> References: <alpine.BSF.2.11.1504060810540.28694@bikeshed.isc.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, Apr 6, 2015 at 1:22 AM, Dan Mahoney <dmahoney@isc.org> wrote: > Hey all, > > Here at ISC, we're seeing a weird issue with the tcpdump command in > 10.0-RELEASE. I'm hoping someone can take a look. > -- > > We have an F-root stats collector that we run as part of an annual event > to gather data across various root servers. It uses the following tcpdump > syntax: > > /usr/sbin/tcpdump -i em0 -G 600 -s 0 -w > /var/tcpdumps/cdg1b-pcap.%Y-%m-%d-%H:%M:%S -z gzip dst net ( > 192.5.5.241/32 or 2001:500:2f::f/128) and not ( src net 204.152.184.0/21 > or src net 149.20.0.0/16 or src net 2001:04F8::/32 and dst port 22 ) > > I've included the full command in case it's needed, but the only bits we > really care about are -G 600 and -z gzip, which should gzip all the log > files, right out of the manpage. > > What this SHOULD give us is a bunch of gzipped files in /var/tcpdumps. In > reality, only the first file is gzipped: > > root@cdg1b:/var/tcpdumps # ls -al > total 66888 > drwxr-xr-x 2 root wheel 1024 Apr 6 08:07 . > drwxr-xr-x 32 root wheel 1024 Nov 3 10:30 .. > -rw-r--r-- 1 root wheel 1762188 Apr 6 04:44 > cdg1b-pcap.2015-04-06-04:34:47.gz > -rw-r--r-- 1 root wheel 5262738 Apr 6 04:54 > cdg1b-pcap.2015-04-06-04:44:47 > -rw-r--r-- 1 root wheel 5371252 Apr 6 05:04 > cdg1b-pcap.2015-04-06-04:54:47 > -rw-r--r-- 1 root wheel 5828832 Apr 6 05:14 > cdg1b-pcap.2015-04-06-05:04:47 > -rw-r--r-- 1 root wheel 5612538 Apr 6 05:24 > cdg1b-pcap.2015-04-06-05:14:47 > -rw-r--r-- 1 root wheel 5864548 Apr 6 05:34 > cdg1b-pcap.2015-04-06-05:24:47 > -rw-r--r-- 1 root wheel 5728222 Apr 6 05:44 > cdg1b-pcap.2015-04-06-05:34:47 > -rw-r--r-- 1 root wheel 5749591 Apr 6 05:54 > cdg1b-pcap.2015-04-06-05:44:47 > -rw-r--r-- 1 root wheel 5845820 Apr 6 06:04 > cdg1b-pcap.2015-04-06-05:54:47 > -rw-r--r-- 1 root wheel 5874731 Apr 6 06:14 > cdg1b-pcap.2015-04-06-06:04:47 > -rw-r--r-- 1 root wheel 5689875 Apr 6 06:24 > cdg1b-pcap.2015-04-06-06:14:47 > -rw-r--r-- 1 root wheel 5592813 Apr 6 06:34 > cdg1b-pcap.2015-04-06-06:24:47 > > Sorry for the messy output. I'd happily log this as a bug (either in > FreeBSD, or upstream) if someone else > could take a look. > > -Dan > I just tried this and it worked fine for me. All files were compressed and suffixed with ".gz". My command was: tcpdump -i wlan0 -p -G 500 -z gzip -s0 -w test.pcap.%Y-%m-%d-%H:%M:%S While I didn't think any options were positional, I did move "-z gzip" before "-G 500" This is on 10-Stable, so it may have been fixed, but I don't see any relevant updates since 10.0. -- Kevin Oberman, Network Engineer, Retired E-mail: rkoberman@gmail.com
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAN6yY1u_5KE0YK60DDxHMg_OMgxhsWe917P11h6_RMCVwV1BSQ>