Issue with TCPdump

[Kevin Oberman]

On Mon, Apr 6, 2015 at 1:22 AM, Dan Mahoney <dmahoney at isc.org> wrote:

> Hey all,
>
> Here at ISC, we're seeing a weird issue with the tcpdump command in
> 10.0-RELEASE.  I'm hoping someone can take a look.
> --
>
> We have an F-root stats collector that we run as part of an annual event
> to gather data across various root servers.  It uses the following tcpdump
> syntax:
>
> /usr/sbin/tcpdump -i em0 -G 600 -s 0 -w
> /var/tcpdumps/cdg1b-pcap.%Y-%m-%d-%H:%M:%S -z gzip dst net (
> 192.5.5.241/32 or 2001:500:2f::f/128) and not ( src net 204.152.184.0/21
> or src net 149.20.0.0/16 or src net 2001:04F8::/32 and dst port 22 )
>
> I've included the full command in case it's needed, but the only bits we
> really care about are -G 600 and -z gzip, which should gzip all the log
> files, right out of the manpage.
>
> What this SHOULD give us is a bunch of gzipped files in /var/tcpdumps.  In
> reality, only the first file is gzipped:
>
> root at cdg1b:/var/tcpdumps # ls -al
> total 66888
> drwxr-xr-x   2 root  wheel     1024 Apr  6 08:07 .
> drwxr-xr-x  32 root  wheel     1024 Nov  3 10:30 ..
> -rw-r--r--   1 root  wheel  1762188 Apr  6 04:44
> cdg1b-pcap.2015-04-06-04:34:47.gz
> -rw-r--r--   1 root  wheel  5262738 Apr  6 04:54
> cdg1b-pcap.2015-04-06-04:44:47
> -rw-r--r--   1 root  wheel  5371252 Apr  6 05:04
> cdg1b-pcap.2015-04-06-04:54:47
> -rw-r--r--   1 root  wheel  5828832 Apr  6 05:14
> cdg1b-pcap.2015-04-06-05:04:47
> -rw-r--r--   1 root  wheel  5612538 Apr  6 05:24
> cdg1b-pcap.2015-04-06-05:14:47
> -rw-r--r--   1 root  wheel  5864548 Apr  6 05:34
> cdg1b-pcap.2015-04-06-05:24:47
> -rw-r--r--   1 root  wheel  5728222 Apr  6 05:44
> cdg1b-pcap.2015-04-06-05:34:47
> -rw-r--r--   1 root  wheel  5749591 Apr  6 05:54
> cdg1b-pcap.2015-04-06-05:44:47
> -rw-r--r--   1 root  wheel  5845820 Apr  6 06:04
> cdg1b-pcap.2015-04-06-05:54:47
> -rw-r--r--   1 root  wheel  5874731 Apr  6 06:14
> cdg1b-pcap.2015-04-06-06:04:47
> -rw-r--r--   1 root  wheel  5689875 Apr  6 06:24
> cdg1b-pcap.2015-04-06-06:14:47
> -rw-r--r--   1 root  wheel  5592813 Apr  6 06:34
> cdg1b-pcap.2015-04-06-06:24:47
>
> Sorry for the messy output.  I'd happily log this as a bug (either in
> FreeBSD, or upstream) if someone else
> could take a look.
>
> -Dan
>

I just tried this and it worked fine for me. All files were compressed and
suffixed with ".gz".

My command was:
tcpdump -i wlan0 -p -G 500 -z gzip -s0 -w test.pcap.%Y-%m-%d-%H:%M:%S

While I didn't think any options were positional, I did move "-z gzip"
before "-G 500"
This is on 10-Stable, so it may have been fixed, but I don't see any
relevant updates since 10.0.
--
Kevin Oberman, Network Engineer, Retired
E-mail: rkoberman at gmail.com