|
A few ideas:
If you're happy with what you're doing except that you also want to delete old files, use a cron job or script that runs every 10 seconds (or whatever) and deletes any file (which must at least partially match the name you specify with the -w switch) exceeding the number of Bytes you entered for the -C parameter for tcpdump.
You can use the "dst portrange" qualifier to search for packets with destination ports not exceeding 9999 (i.e., tcpdump -i eth0 dst portrange 0-9999).
If you have some script that reads these files in and parses them for information then deletes them, you could save yourself the bother of writing a file, and instead use tcpdump's -l option to enable line buffering. This will let you pipe the output of tcpdump directly into a command(s) for parsing.
Good luck.
|