主页 / ubuntu / 问题 / 1100347
Accepted
Krisz
Asked: 2018-12-13 06:55:43 +0800 CST

Tcpdump 异常停止

  • 772

我正在寻找一种可靠的解决方案来为测试自动化进行包捕获。

现在，tcpdump 已与以下命令一起使用。

sudo tcpdump -i ens160  -w filename.pcap -G 60 -W 1

我停止 tcpdump：

kill -s SIGINT <pid>

20 次中有 1 次 tcpdump 无法正常退出，pcap 文件将被损坏。

有什么方法可以确保 tcpdump 正确退出？

networking wireshark tcpdump

1 个回答

  1. Best Answer

    有两种方法可以避免截断转储文件：

    1. 正如 Doug Smythies 所建议的，使用终止信号 ( SIGTERM) 而不是SIGINT终止tcpdump进程：

      kill <pid>

    2. 告诉tcpdump在保存每个数据包时将数据包直接写入文件（选项-U）。这样，即使使用 SIGINT，文件也不会被截断。从man tcpdump：

       -U
   --packet-buffered
          If the -w option is not specified, make the  printed  packet
          output  ``packet-buffered''; i.e., as the description of the
          contents of each packet is printed, it will  be  written  to
          the standard output, rather than, when not writing to a ter‐
          minal, being written only when the output buffer fills.

          If the -w option is specified, make  the  saved  raw  packet
          output  ``packet-buffered'';  i.e., as each packet is saved,
          it will be written to the output  file,  rather  than  being
          written only when the output buffer fills.

          The  -U flag will not be supported if tcpdump was built with
          an older version of libpcap that lacks the pcap_dump_flush()
          function.
    • 1

相关问题