Wednesday, May 5, 2010

cron for tcpdump script

Recently I needed to sniff some traffic at one of my remote data centers. I brought up an old box with linux and needed to capture some traffic every 15 minutes.

This script will create a file with a date and time for the name then start dumping tcpdump data to it. Here is my script that I used to grab the traffic:

#!/bin/bash
killall tcpdump
var=$(date +%G%m%d-%k%M)
/usr/sbin/tcpdump -i eth0 -C 10 -w /home/user/$var.txt

Since the first line of the script kills any tcpdump processes that are currently running, I just set the crontab to run every 15 minutes, it will kill the last tcpdump and create a new file and start the process all over again.

Here is the crontab statement:

00,15,30,45 * * * * /path_to_crantab.sh

No comments: