Save output of sessions to continuous logs

Question

I want to capture everything from a mirrored port to my router. I want to be able to get captures in one hour increments continuously for four days then start wrapping these captures so the hard drive does not fill up.

Is there a way to leave Wireshark running, then “cut pcap’s” every hour, then start wrapping these files after four days?

Answer 1

A command I use very often is:

dumpcap -i eth0 -w file.cap -b filesize:16384 -b files:1024

This command will capture from interface eth0 to a ring buffer of 1024 files of 16MB size. The filenames will be file_NNNNN_YYYYMMDDHHMMSS.cap. After the 1024th file has been written, the 1st will be deleted and the 1025th will be created.

Of course you can change the parameters to your liking. If you do want one-hour files for 4 days, you can use:

dumpcap -i eth0 -w file.cap -b duration:3600 -b files:96

Of course you have no guarantee that your drive won't fill up, as you don't know how much data will be in each hour.

Answer 2

In Wireshark, if you go to the Capture Options before starting your capture, you can do what you need Simply specify a folder and filename (which becomes the prefix for subsequent capture), check Use Multiple Files.Then check the box and fill-in Next File Every "1 hour" and check and fill-in Ring Buffer with "96" files. Note however that Wireshark will attempt to dissect the traffic it captures and consumes memory doing so.

So as has been pointed out by Sake and Bill, dumpcap is probably the best for continuous logging, as it does a raw capture and doesn't need to do any dissecting to build up state and consume memory.

Answer 3

For continuous capturing, use dumpcap (the program used by wireshark and tshark to do the actual capture).

Also: see 'dumpcap -h' (or the dumpcap man page) for info on how to limit capture files to one hour and how to wrap the files after "n" files.

Answer 4

Thanks all, these are great ways to do this..