Sample Header Ad - 728x90

Why is tcpdump output file empty?

2 votes
5 answers
14146 views
On my Red Hat Enterprise Linux Server release 6.5 when saving a tcpdump capture to a file with the -w option, the resulting file is empty: [root@plop ~]# tcpdump -n -w tcpdump.cap listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes ^C217 packets captured 217 packets received by filter 0 packets dropped by kernel [root@plop ~]# cat tcpdump.cap [root@plop ~]# ll tcpdump.cap -rw-r-----. 1 root root 0 Aug 25 14:13 tcpdump.cap [root@plop ~]# I also tried to redirect the output of the command with > and &>, but I always get an empty file... What could be the reason for this? NB: - I can see a correct output in the terminal (many packets) when not redirecting to a file - I did the same with thsark and it worked as expected (the output file was correct) - The verison of tcpdump is tcpdump version 4.1-PRE-CVS_2012_02_01 - The version of libpcap is libpcap version 1.4.0 - I tried with -U option, it didn't fix the problem.
Asked by sdabet (1061 rep)
Aug 25, 2015, 09:56 AM
Last activity: Oct 5, 2023, 12:45 AM