Hello! I'm trying to capture traffic with applying tshark filters in realtime. #Capturing command is the following: tshark -i eth6 -i eth7 -R '(tcp.analysis.retransmission or tcp.analysis.fast_retransmission or tcp.analysis.duplicate_ack_frame)' -Tfields -Eseparator="|" -Eoccurrence=l -e frame.time -e ip.src -e tcp.srcport -e ip.dst -e tcp.dstport -e expert | sed "..." > /tmp/retransmissions.txt After the some time odd situation occurs: file /tmp/retransmissions.txt stop grows, but wireshark temporary file still grows (looks like everything is fine and that traffic still captures). If I will start additional tshark process with the same filters (without redirection to file), I will see that retransmissions are present, but 1st process of the tshark will not redirect to output these packets. So the situation looks like redirection unexpectedly stops its work. Every necessary process runs in this time: # ps aux |grep tshark root 21992 4.2 1.0 493688 304092 pts/1 S 09:56 1:39 /usr/bin/tshark -i eth6 -i eth7 -R (tcp.analysis.retransmission or tcp.analysis.duplicate_ack_frame) -Tfields -Eseparator | -Eoccurrence l -e frame.time -e ip.src -e tcp.srcport -e ip.dst -e tcp.dstport -e expert # ps aux |grep dumpcap root 22008 3.0 0.0 202288 26428 pts/1 Sl 09:56 1:48 /usr/bin/dumpcap -t -n -i eth6 -i eth7 -Z none # free total used free shared buffers cached Mem: 28729376 3672100 25057276 0 192384 1397272 -/+ buffers/cache: 2082444 26646932 Swap: 6143992 0 6143992 # tshark -v TShark 1.10.3 (SVN Rev Unknown from unknown) # cat /etc/redhat-release CentOS release 6.5 (Final) Do you have any ideas why this situation may occurs and how to resolve it? Thanks in advance! |
tshark output is buffered. Please try tshark option -l and check if that helps. Same for sed, option -u. Regards Kurt, I have tried this solution, unfortunately problem has occurred again.
(03 Dec '13, 02:59)
mrav
O.K. then please do the following: As soon as the output stalls, run the following commands
Then post the output files
(03 Dec '13, 03:13)
Kurt Knochner ♦
cat tshark.strace
cat sed.starce
SIGKILL and close (0) has appeared in strace files after I have stopped the capturing script.
(03 Dec '13, 05:11)
mrav
is that the only line in tshark.trace? BTW: What is the output of the following commands, while the output stalls
(03 Dec '13, 05:51)
Kurt Knochner ♦
Correct, only this line, which is not gave us any useful information..unfortunately. Will try additionally to run strace from the beginning, when tshark works correctly .Maybe this will give additional information. Disk space is present, while the output stalls. Anyway will try again to reproduce an issue and check the command output. Many thanks for your help!
(03 Dec '13, 05:57)
mrav
that will generate way too much data.... Please run strace on dumpcap while the output stalls.
(03 Dec '13, 06:59)
Kurt Knochner ♦
Output of commands is the following: lsof -n |egrep '(tshark|dumpcap)'
df -h
strace
(03 Dec '13, 11:08)
mrav
showing 5 of 7
show 2 more comments
|