how set time for tcpdump

You don't need any script, if the following simple method is good enough for you.

The first command will schedule tcpdump at 15:30, using the command at (should be available on any Unix like system).

echo "/usr/sbin/tcpdump -ni eth0 -s0 -w /var/tmp/capture_eth0.pcap host 1.2.3.4 and port 80" | at 15:30

The second command will schedule the 'end' of tcpdump, by simply killing all running tcpdump processes 5 minutes later (15:35).

echo "killall tcpdump; killall tcpdump" | at 15:35

atq will show the jobs

atq
4 Thu Jun 12 15:35:00 2014 a surfer
3 Thu Jun 12 15:30:00 2014 a surfer

And at -c [jobid] will show the content of the jobs

at -c 3 | tail -1
tcpdump -ni eth0 -s0 -w /var/tmp/capture_eth0.pcap host 1.2.3.4 and port 80

at -c 4 | tail -1
killall tcpdump; killall tcpdump

If you need a solution for a more complex environment, you'll have to write a shell script that gets started with the at command (or by cron) and that kills only the tcpdump instance that was started by the script after some time (hint: SIGALRM). However, that's plain shell scripting and this is certainly the wrong place to ask for shell scripting tips ;-)

Regards
Kurt