From owner-freebsd-net@FreeBSD.ORG Tue Apr 7 05:47:17 2015 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id BD02C90E for ; Tue, 7 Apr 2015 05:47:17 +0000 (UTC) Received: from mail-ie0-x230.google.com (mail-ie0-x230.google.com [IPv6:2607:f8b0:4001:c03::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 7FE821DA for ; Tue, 7 Apr 2015 05:47:17 +0000 (UTC) Received: by iebmp1 with SMTP id mp1so38309819ieb.0 for ; Mon, 06 Apr 2015 22:47:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:date:message-id:subject :from:to:cc:content-type; bh=9bYgqFXHFLU0v3oD1mtSJMNNDotdGh/3UPw6T4lY5mI=; b=qzQ7IFsS4xBUSPNMrYSt0PTTFV4SH7Xva1iPq7pp1DL9h7VJl8GK0q2ByctFZ4YL+q LCpdT3rhruKVCM0z3WagRy1ZPlsBdapG8Dhc2qcfh4GEju/N+aZB+881sZyG/vCq+qcd 97cMOahsfFxoHopMnEDWCpwXzK1mx17Ehn18YdkxYVEe53/TUQGLGX5mpLRo/nOnNVTr ppVtLpcOOq391ydPaKN06CM1ylQj+ys8rpAhJWP/QHfB7ruCZ2C7WhTw6YPCyNwlzBhn x62TnhTF68cIzlIvsg2GjsqRSIwTOGHxNqnLguDo+dTC+UOGk+XkDFR1tSc+PtAY6dLD O7XQ== MIME-Version: 1.0 X-Received: by 10.42.23.17 with SMTP id q17mr7334066icb.4.1428385636885; Mon, 06 Apr 2015 22:47:16 -0700 (PDT) Sender: kob6558@gmail.com Received: by 10.107.174.86 with HTTP; Mon, 6 Apr 2015 22:47:16 -0700 (PDT) In-Reply-To: References: Date: Mon, 6 Apr 2015 22:47:16 -0700 X-Google-Sender-Auth: YArqJqM5xKfxjw3R0abqvH2DuNw Message-ID: Subject: Re: Issue with TCPdump From: Kevin Oberman To: Dan Mahoney Content-Type: text/plain; charset=UTF-8 X-Content-Filtered-By: Mailman/MimeDel 2.1.18-1 Cc: "freebsd-net@freebsd.org" , plosher@isc.org X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Apr 2015 05:47:17 -0000 On Mon, Apr 6, 2015 at 1:22 AM, Dan Mahoney wrote: > Hey all, > > Here at ISC, we're seeing a weird issue with the tcpdump command in > 10.0-RELEASE. I'm hoping someone can take a look. > -- > > We have an F-root stats collector that we run as part of an annual event > to gather data across various root servers. It uses the following tcpdump > syntax: > > /usr/sbin/tcpdump -i em0 -G 600 -s 0 -w > /var/tcpdumps/cdg1b-pcap.%Y-%m-%d-%H:%M:%S -z gzip dst net ( > 192.5.5.241/32 or 2001:500:2f::f/128) and not ( src net 204.152.184.0/21 > or src net 149.20.0.0/16 or src net 2001:04F8::/32 and dst port 22 ) > > I've included the full command in case it's needed, but the only bits we > really care about are -G 600 and -z gzip, which should gzip all the log > files, right out of the manpage. > > What this SHOULD give us is a bunch of gzipped files in /var/tcpdumps. In > reality, only the first file is gzipped: > > root@cdg1b:/var/tcpdumps # ls -al > total 66888 > drwxr-xr-x 2 root wheel 1024 Apr 6 08:07 . > drwxr-xr-x 32 root wheel 1024 Nov 3 10:30 .. > -rw-r--r-- 1 root wheel 1762188 Apr 6 04:44 > cdg1b-pcap.2015-04-06-04:34:47.gz > -rw-r--r-- 1 root wheel 5262738 Apr 6 04:54 > cdg1b-pcap.2015-04-06-04:44:47 > -rw-r--r-- 1 root wheel 5371252 Apr 6 05:04 > cdg1b-pcap.2015-04-06-04:54:47 > -rw-r--r-- 1 root wheel 5828832 Apr 6 05:14 > cdg1b-pcap.2015-04-06-05:04:47 > -rw-r--r-- 1 root wheel 5612538 Apr 6 05:24 > cdg1b-pcap.2015-04-06-05:14:47 > -rw-r--r-- 1 root wheel 5864548 Apr 6 05:34 > cdg1b-pcap.2015-04-06-05:24:47 > -rw-r--r-- 1 root wheel 5728222 Apr 6 05:44 > cdg1b-pcap.2015-04-06-05:34:47 > -rw-r--r-- 1 root wheel 5749591 Apr 6 05:54 > cdg1b-pcap.2015-04-06-05:44:47 > -rw-r--r-- 1 root wheel 5845820 Apr 6 06:04 > cdg1b-pcap.2015-04-06-05:54:47 > -rw-r--r-- 1 root wheel 5874731 Apr 6 06:14 > cdg1b-pcap.2015-04-06-06:04:47 > -rw-r--r-- 1 root wheel 5689875 Apr 6 06:24 > cdg1b-pcap.2015-04-06-06:14:47 > -rw-r--r-- 1 root wheel 5592813 Apr 6 06:34 > cdg1b-pcap.2015-04-06-06:24:47 > > Sorry for the messy output. I'd happily log this as a bug (either in > FreeBSD, or upstream) if someone else > could take a look. > > -Dan > I just tried this and it worked fine for me. All files were compressed and suffixed with ".gz". My command was: tcpdump -i wlan0 -p -G 500 -z gzip -s0 -w test.pcap.%Y-%m-%d-%H:%M:%S While I didn't think any options were positional, I did move "-z gzip" before "-G 500" This is on 10-Stable, so it may have been fixed, but I don't see any relevant updates since 10.0. -- Kevin Oberman, Network Engineer, Retired E-mail: rkoberman@gmail.com