Tcpdump stop ungracefully

Question

I am looking for a reliable solution to do package capture for test automation.

Right now, tcpdump has been used with the following command.

sudo tcpdump -i ens160  -w filename.pcap -G 60 -W 1

I stop tcpdump with:

kill -s SIGINT <pid>

1 out of 20 time tcpdump fails to exit properly, and the pcap file will be damaged.

Is there any way to make sure tcpdump will exit properly?

Why not never issue the `kill` command? The tcpdump command will terminate gracefully after a maximum of one minute anyhow, with a complete and not corrupted pcap file. — Doug Smythies, Dec 12 '18 at 15:45
The time is a secondary defense level only to make sure, tcpdump will be terminated even if someone terminate the test execution. I do not know all the time how long the test will run, only know what is the worst case. — Krisz, Dec 12 '18 at 16:03

score 1 · Accepted Answer · answered Feb 19 '20 at 13:16

There are two ways to avoid a truncated dump file:

As suggested by Doug Smythies, use termination signal (SIGTERM) instead of SIGINT to kill the tcpdump process:
```
kill <pid>
```
Tell tcpdump to write packet directly to file as each packet is saved (option -U). This way, even using SIGINT, the file will not be truncated. From man tcpdump :

   -U
   --packet-buffered
          If the -w option is not specified, make the  printed  packet
          output  ``packet-buffered''; i.e., as the description of the
          contents of each packet is printed, it will  be  written  to
          the standard output, rather than, when not writing to a ter‐
          minal, being written only when the output buffer fills.

          If the -w option is specified, make  the  saved  raw  packet
          output  ``packet-buffered'';  i.e., as each packet is saved,
          it will be written to the output  file,  rather  than  being
          written only when the output buffer fills.

          The  -U flag will not be supported if tcpdump was built with
          an older version of libpcap that lacks the pcap_dump_flush()
          function.

Tcpdump stop ungracefully

1 Answers1