Hi there, I've an issue with dumpcap command. First of all i'm working in a Linux environment (on Raspbian, on a Raspberry Pi, exactly). I've a PHP frontend, which ask the user to type parameters, and then when he launch the capture (by clicking on a button), the following php code is executed : shell_exec("sudo nohup dumpcap -P -f \"".$fport."\" -b duration:".$ftime." -i ".$finterface." -w /mnt/hdd/files_to_proceed/REC.pcap > /dev/null &"); My Raspberry Pi is well connected to the network, the capture correctly start and all the packets are captured and stored in correct files. That's a good point. My problem is, if i chose 5min duration for example, dumpcap will correctly split files every 5 minutes, until he magically stops splitting and store all the packets in the same .pcap file during more than 5 minutes. And, about a random time, he suddenly resplit files every 5 minutes correctly. After many tests, i figured out that : I don't know if you guys already had that issue, if it's due to dumpcap lib or not, but i really need help on this ! asked 24 Apr '14, 06:03 Lecclem |
One Answer:
Sounds like a bug to me, and a tricky one since it can not always be reproduced. Most people I know do not use the "-b duration" switch since can get you into trouble when the line has bursty traffic patterns. Which is why usually "-b filesize" is used instead, to keep the capture files consistent in size (e.g. to be able to load them). So if you need time based splitting it is quite possible that this problem did not occur to anyone else, or they just used the filesize based splitting as a workaround and didn't say anything :-) You might want to head over to the Bugtracker to open a report. answered 24 Apr '14, 06:26 Jasper ♦♦ |
Actually I think there's already a similar bug report for this. It's quite old so a report that it's still a problem would be useful.
Thanks for your answers ! I am currently working on my own way to capture packets (including time filter) through libpcap library in C, i see no other way (besides use a filesize filter, which will be my ultimate last solution)... But i'm glad that bug was reported and i'll try to "up" that report ASAP.