shell脚本中使用tcpdump抓包

1. 启动脚本

#!/bin/bash
filename='view_history_'`date +%F-%H:%M:%S`
touch $filename
#没有后面的tdid则无法退出tcpdump进程
tcpdump -i br0 -s 0 -A 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420' -w $filename & tdid='pgrep tcpdump'


while [ "1" = "1" ]
do
file_size=`du $filename|awk '{print $1}'`
echo 'file_size'$file_size
#文件达到100M时，重启tcpdump
if [ $file_size -ge 102400 ]
then
echo 'data is enough,stop tcpdump,create new file'
killall tcpdump
#备份名称，用于后面压缩
filenameBak=$filename
filename='view_history_'`date +%F-%H:%M:%S`
touch $filename
tcpdump -i br0 -s 0 -A 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420' -w $filename & tdid='pgrep tcpdump'
gzip $filenameBak
else
echo 'data not enough.'
fi
sleep 5s
done

2. 关闭脚本

#!/bin/bash
#杀死tcpdump进程
ps -ef |grep tcpdump |awk '{print $2}'|xargs kill -9
#删除文件
rm -rf *_history_*