From owner-freebsd-net@FreeBSD.ORG Mon Apr 6 08:22:59 2015 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id EE73E609 for ; Mon, 6 Apr 2015 08:22:59 +0000 (UTC) Received: from mx.ams1.isc.org (mx.ams1.isc.org [199.6.1.65]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "*.isc.org", Issuer "RapidSSL CA" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id AF7CA6C2 for ; Mon, 6 Apr 2015 08:22:58 +0000 (UTC) Received: from bikeshed.isc.org (bikeshed.isc.org [149.20.48.19]) (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)) (Client CN "mail.isc.org", Issuer "RapidSSL CA" (not verified)) by mx.ams1.isc.org (Postfix) with ESMTPS id 1C3FB1FCAD6 for ; Mon, 6 Apr 2015 08:22:54 +0000 (UTC) Received: by bikeshed.isc.org (Postfix, from userid 10302) id EE865216C43; Mon, 6 Apr 2015 08:22:52 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by bikeshed.isc.org (Postfix) with ESMTP id EDE39216C40; Mon, 6 Apr 2015 08:22:52 +0000 (UTC) Date: Mon, 6 Apr 2015 08:22:52 +0000 (UTC) From: Dan Mahoney To: freebsd-net@freebsd.org Subject: Issue with TCPdump Message-ID: User-Agent: Alpine 2.11 (BSF 23 2013-08-11) X-OpenPGP-Key-ID: 0xE919EC51 MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,T_RP_MATCHES_RCVD autolearn=ham autolearn_force=no version=3.4.0 X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on mx.ams1.isc.org Cc: plosher@isc.org X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Apr 2015 08:23:00 -0000 Hey all, Here at ISC, we're seeing a weird issue with the tcpdump command in 10.0-RELEASE. I'm hoping someone can take a look. -- We have an F-root stats collector that we run as part of an annual event to gather data across various root servers. It uses the following tcpdump syntax: /usr/sbin/tcpdump -i em0 -G 600 -s 0 -w /var/tcpdumps/cdg1b-pcap.%Y-%m-%d-%H:%M:%S -z gzip dst net ( 192.5.5.241/32 or 2001:500:2f::f/128) and not ( src net 204.152.184.0/21 or src net 149.20.0.0/16 or src net 2001:04F8::/32 and dst port 22 ) I've included the full command in case it's needed, but the only bits we really care about are -G 600 and -z gzip, which should gzip all the log files, right out of the manpage. What this SHOULD give us is a bunch of gzipped files in /var/tcpdumps. In reality, only the first file is gzipped: root@cdg1b:/var/tcpdumps # ls -al total 66888 drwxr-xr-x 2 root wheel 1024 Apr 6 08:07 . drwxr-xr-x 32 root wheel 1024 Nov 3 10:30 .. -rw-r--r-- 1 root wheel 1762188 Apr 6 04:44 cdg1b-pcap.2015-04-06-04:34:47.gz -rw-r--r-- 1 root wheel 5262738 Apr 6 04:54 cdg1b-pcap.2015-04-06-04:44:47 -rw-r--r-- 1 root wheel 5371252 Apr 6 05:04 cdg1b-pcap.2015-04-06-04:54:47 -rw-r--r-- 1 root wheel 5828832 Apr 6 05:14 cdg1b-pcap.2015-04-06-05:04:47 -rw-r--r-- 1 root wheel 5612538 Apr 6 05:24 cdg1b-pcap.2015-04-06-05:14:47 -rw-r--r-- 1 root wheel 5864548 Apr 6 05:34 cdg1b-pcap.2015-04-06-05:24:47 -rw-r--r-- 1 root wheel 5728222 Apr 6 05:44 cdg1b-pcap.2015-04-06-05:34:47 -rw-r--r-- 1 root wheel 5749591 Apr 6 05:54 cdg1b-pcap.2015-04-06-05:44:47 -rw-r--r-- 1 root wheel 5845820 Apr 6 06:04 cdg1b-pcap.2015-04-06-05:54:47 -rw-r--r-- 1 root wheel 5874731 Apr 6 06:14 cdg1b-pcap.2015-04-06-06:04:47 -rw-r--r-- 1 root wheel 5689875 Apr 6 06:24 cdg1b-pcap.2015-04-06-06:14:47 -rw-r--r-- 1 root wheel 5592813 Apr 6 06:34 cdg1b-pcap.2015-04-06-06:24:47 Sorry for the messy output. I'd happily log this as a bug (either in FreeBSD, or upstream) if someone else could take a look. -Dan