先查网卡
tcpdump -D
再抓包
/usr/sbin/tcpdump -i eth0 -s 0 -w /tmp/2014-08-27@168.pcap -s 0
加ip和端口
/usr/sbin/tcpdump host 172.16.29.40 and port 4600 -i eth0 -s 0 -w /tmp/2014-08-27@168.pcap -s 0
一直抓包
#!/bin/bash
#script name:/home/maindump.sh
#export LANG=en
while :
do
STIME=`date +%F"@"%H%M%S`
DATE_DIR=`date +%F`
if [ ! -d /home/data/$DATE_DIR ];then
mkdir -p /home/data/$DATE_DIR
fi
#unit:byte;100MB
MAXSIZE=100000000
/usr/sbin/tcpdump -i eth1 -s 0 -w /home/data/$DATE_DIR/$STIME.pcap -s 0 &
sleep 1
DUMPPID=`ps -ef|grep "tcpdump -i eth1"|grep pcap|awk '{print $2}'`
PACKSIZE=`ls -l /home/data/$DATE_DIR|grep "$STIME.pcap"|awk '{print $5}'`
while [ "$PACKSIZE" -lt "$MAXSIZE" ];do
PACKSIZE=`ls -l /home/data/$DATE_DIR|grep "$STIME.pcap"|awk '{print $5}'`
sleep 1m
done
kill -9 $DUMPPID
ETIME=`date +%H%M%S`
mv /home/data/$DATE_DIR/$STIME.pcap /home/data/$DATE_DIR/$STIME-$ETIME.pcap
gzip /home/data/$DATE_DIR/*.pcap
sleep 5
done