I'm not sure what you mean, there are two loops, the while true loop and the until loop.

All the until loop does is every 30 minutes check if the dates match or not. Once they do, it does all the work in the while loop which includes updating the dates:

Code:

while true; do  
        until [[ "$DATE" == "$TDATE" ]]; do
            sleep 1800
        done
        killDump
        zipPcap $PCAPFILE &
        PCAPFILE=/tmp/mgmt.$(date "+%H.%M.%S.%m.%d").pcap
        tcpdump -i eth0 -nn -vv -s 1500 net 192.168.5 -w $PCAPFILE   2>&1 & 
        dumpPid=$!
        TDATE=$(date --date='-1 days ago' "+%m.%d.%y")
        DATE=$(date "+%m.%d.%y")
    done

Every time the red part completes, it does the blue part which includes updating the variables that red relies on.

---------- Post updated at 12:56 PM ---------- Previous update was at 12:44 PM ----------

Well my main concern isn't having multiple zips going on at the same time. I mean it should only be zipping the file once a day, and I highly doubt that by the time the next zip comes around the last one will still be running.

My concern is that I don't want the next instance of tcpdump to have to wait for the zip to complete. I wanted the zip to run in the background while the next tcpdump starts.

I decided to do some more testing on a VM on my laptop, and I noticed that unlike what I wanted, the tcpdump was waiting for the zip to complete before starting again, so I moved the ampersand inside the zipPcap function, and now it seems to be working. I'm watching the files get created in real time, and when one stops writing 2 more files appear, the .gz, and the new .pcap. Once the .gz is done, the original file gets deleted.

My testing version:

Code:

#!/bin/bash

PCAPFILE=/tmp/mgmt.$(date "+%H.%M.%S.%m.%d").pcap

tcpdump -i eth0 -nn -vv -s 1500 -w $PCAPFILE   2>&1 & 
dumpPid=$!
i=1
killnum=3

TDATE=$(date --date='-1 days ago' "+%m.%d.%y")
DATE=$(date "+%m.%d.%y")


killDump ()
{
    kill $dumpPid
}


zipPcap ()
{
    gzip -c $1 > $1.gz && rm $1 &
}


    while true; do
        until [[ "$i" == "$killnum" ]]; do
            sleep 30
	    let i=i+1
	    echo $i
	    echo $dumpPid
        done
        killDump
        zipPcap $PCAPFILE 
        PCAPFILE=/tmp/mgmt.$(date "+%H.%M.%S.%m.%d").pcap
        tcpdump -i eth0 -nn -vv -s 1500  -w $PCAPFILE   2>&1 & 
        dumpPid=$!
        TDATE=$(date --date='-1 days ago' "+%m.%d.%y")
        DATE=$(date "+%m.%d.%y")
	i=0
    done

Oh, and to answer your question, the box I'm working on has 16 cores...


So far as zipping the pcap in real time...honestly, I didn't know that was an option.