Hello !

I am using
tcpdump -w /tr.cap -p -n -s 0 "udp"
to trace my network trafic.
(analysing later)

I want to reduce the size of the trace files.
Firtst i can use the great -C option but old files are not deleted...
Second I don't want trace RTP packet but i can't find how to use ("not rtp" , "udp.port < 10000"...)

Idealy i want trace only few firsts bytes of RTP but all bytes of other...

Any idea ?
Thanks

A few ideas:

If you're happy with what you're doing except that you also want to delete old files, use a cron job or script that runs every 10 seconds (or whatever) and deletes any file (which must at least partially match the name you specify with the -w switch) exceeding the number of Bytes you entered for the -C parameter for tcpdump.

You can use the "dst portrange" qualifier to search for packets with destination ports not exceeding 9999 (i.e., tcpdump -i eth0 dst portrange 0-9999).

If you have some script that reads these files in and parses them for information then deletes them, you could save yourself the bother of writing a file, and instead use tcpdump's -l option to enable line buffering. This will let you pipe the output of tcpdump directly into a command(s) for parsing.

Good luck.