TCPDUMP generates multiple files or corrupts data because the capture process is interrupted, disk space runs out, or the rotation logic is misconfigured. This behavior usually stems from improper use of the
-w flag combined with system-level file locking or insufficient permissions to write continuous streams to a single destination.
Understanding TCPDUMP File Rotation and Output Flags
The primary cause of "multiple files" appearing in your directory is often a misunderstanding of how TCPDUMP handles output redirection versus file rotation. By default, if you specify an output file using the
-w flag without rotation parameters, TCPDUMP attempts to write all packets to that single file until it is killed or the disk fills up. If you see multiple files like
capture.pcap.1,
capture.pcap.2, this indicates that a wrapper script or the operating system’s logging daemon is rotating the file, not TCPDUMP itself.
However, if you are seeing random modifications or fragmented captures within a short timeframe, check if you are accidentally running multiple instances of TCPDUMP targeting the same interface. Each instance will create its own stream. To ensure a single, continuous capture, you must verify that only one process holds the network interface in promiscuous mode. You can check for conflicting processes by running:
ps aux | grep tcpdump
If multiple entries appear, kill the extra processes using
kill -9 <PID>. Additionally, ensure you are not piping the output to a command that closes the file descriptor prematurely. For example, redirecting to a script that exits immediately will truncate the file, causing TCPDUMP to restart or fail silently depending on the error handling.
Common Flag Misconfigurations
A frequent error is mixing the
-W (file count) and
-G (time interval) flags incorrectly. These flags are designed for automatic rotation. If you set
-G 60 to rotate every 60 seconds but do not provide a unique filename pattern using
-w with a wildcard or timestamp, TCPDUMP may overwrite files or create unpredictable naming schemes. The correct syntax for time-based rotation is:
tcpdump -i eth0 -w /tmp/capture_%Y%m%d_%H%M%S.pcap -G 60
This creates distinct files per minute. If you want a single file, remove these flags entirely. Always test your command with a small duration first to verify the output structure before running long-term captures.
Disk Space and Permissions Issues
When TCPDUMP modifies files randomly or stops writing, it is often due to low disk space or permission errors. TCPDUMP requires write access to the target directory. If the user lacks permissions, the tool might fail to open new files or append to existing ones, leading to truncated captures. Check the permissions of your output directory:
ls -ld /path/to/output
Ensure the user running TCPDUMP has read/write/execute permissions. If you are capturing to a network-mounted drive, latency or connection drops can cause the file handle to become invalid, resulting in broken or partial files. In such cases, local SSD storage is recommended for high-throughput interfaces.
Furthermore, monitor your disk usage during capture. If the disk reaches 100%, TCPDUMP cannot write new packets. It may either crash or continue writing to memory buffers until they overflow, which can lead to data loss. Use
df -h to monitor available space. If you anticipate large captures, implement a monitoring script that alerts you when free space drops below a threshold, such as 10%.
Network Interface and Buffer Overflows
Random modifications or missing packets can also result from buffer overflows on the network interface. High-traffic environments may overwhelm the kernel’s packet capture buffer, causing TCPDUMP to drop packets. While this doesn’t always create multiple files, it results in incomplete data that appears corrupted when analyzed. Adjust the buffer size using the
-B flag, which sets the socket buffer size in kilobytes:
tcpdump -i eth0 -B 10000 -w capture.pcap
Increasing the buffer size helps accommodate traffic spikes. However, if the interface hardware itself is throttling, no amount of buffer tuning will solve the issue. In these scenarios, consider using specialized hardware or offloading the capture to a dedicated network tap.
For related troubleshooting on network connectivity issues, you might find
IPSec Tunnel Established, but nmap and ping Unable: Troubleshooting Ubuntu VM Network Traffic helpful, as it addresses similar packet flow problems.
Verifying Capture Integrity
After troubleshooting, verify the integrity of your pcap files using
tshark or
tcpdump’s built-in verification. Run:
tcpdump -r capture.pcap -nn
If the output shows errors or truncation, the file is likely corrupted. Re-run the capture with verbose logging enabled (
-v) to identify where the process failed. Consistent logging helps pinpoint whether the issue is environmental, such as disk I/O bottlenecks, or configuration-related.
Frequently Asked Questions
Why does TCPDUMP stop writing after a few minutes?
It likely stopped because the disk filled up or the process was killed by the system due to resource limits. Check your system logs for OOM (Out of Memory) errors or disk full notifications, and ensure you have sufficient storage space allocated for the capture duration.
How do I prevent TCPDUMP from creating numbered backup files?
Remove any
-W or
-G flags from your command line. These flags explicitly instruct TCPDUMP to rotate files based on count or time. Without them, TCPDUMP writes continuously to the single file specified by
-w until the process ends.
Can I capture to a remote server directly?
Yes, but it is not recommended for high-volume traffic due to network latency and potential packet loss. Instead, capture locally and use
rsync or
scp to transfer the completed pcap files securely to the remote server after the capture session finishes.
What causes "permission denied" errors when saving files?
This occurs when the user running TCPDUMP lacks write permissions for the target directory or file. Ensure you run the command with appropriate privileges, such as using
sudo, or change the ownership of the output directory using
chown to match your user account.
Is there a way to automatically delete old captures?
TCPDUMP does not have a built-in auto-delete feature. You should use a separate cron job or logrotate configuration to manage old pcap files. Logrotate can be configured to compress and delete files older than a specific number of days, keeping your disk space clean.