This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi there, I've an issue with dumpcap command. First of all i'm working in a Linux environment (on Raspbian, on a Raspberry Pi, exactly). I've a PHP frontend, which ask the user to type parameters, and then when he launch the capture (by clicking on a button), the following php code is executed :

shell_exec("sudo nohup dumpcap -P -f \"".$fport."\" -b duration:".$ftime." -i ".$finterface." -w /mnt/hdd/files_to_proceed/REC.pcap > /dev/null &");

My Raspberry Pi is well connected to the network, the capture correctly start and all the packets are captured and stored in correct files. That's a good point. My problem is, if i chose 5min duration for example, dumpcap will correctly split files every 5 minutes, until he magically stops splitting and store all the packets in the same .pcap file during more than 5 minutes. And, about a random time, he suddenly resplit files every 5 minutes correctly. After many tests, i figured out that :
- This issue is independent of the amount of time chosen
- It appears at and for a random time
- Sometimes it doesn't show up and the whole capture is a success
Finally, the tests were fulfill during whole nights (so for many hours), simply because this feature is supposed to work 24 hours a day for several months.

I don't know if you guys already had that issue, if it's due to dumpcap lib or not, but i really need help on this !

asked 24 Apr '14, 06:03

Lecclem's gravatar image

Lecclem
1112
accept rate: 0%


Sounds like a bug to me, and a tricky one since it can not always be reproduced.

Most people I know do not use the "-b duration" switch since can get you into trouble when the line has bursty traffic patterns. Which is why usually "-b filesize" is used instead, to keep the capture files consistent in size (e.g. to be able to load them). So if you need time based splitting it is quite possible that this problem did not occur to anyone else, or they just used the filesize based splitting as a workaround and didn't say anything :-)

You might want to head over to the Bugtracker to open a report.

permanent link

answered 24 Apr '14, 06:26

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Actually I think there's already a similar bug report for this. It's quite old so a report that it's still a problem would be useful.

(24 Apr '14, 11:55) JeffMorriss ♦

Thanks for your answers ! I am currently working on my own way to capture packets (including time filter) through libpcap library in C, i see no other way (besides use a filesize filter, which will be my ultimate last solution)... But i'm glad that bug was reported and i'll try to "up" that report ASAP.

(29 Apr '14, 01:02) Lecclem
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×832
×89
×12

question asked: 24 Apr '14, 06:03

question was seen: 1,961 times

last updated: 29 Apr '14, 01:02

p​o​w​e​r​e​d by O​S​Q​A