What worries me is by the end of the day you'll have a bunch of tcpdump processes running, unless you go in and kill them off.

tcpdump might do what you want it to do, needing a script only to start it once per day and stop it once per day. Check 'man tcpdump', specifically for the "-G" and "-w" options.

Also beware logging that much traffic on a busy system. There's no guarantee that you catch every packet, and the chance that you fill you filesystem in short order.

Edit: It looks like the -G option doesn't show up until version 4.0.0 - something like this should work in that version, but I can't test it at the moment:

Code:

# tcpdump -s2000 -w'flowroute-%H%M.pcap' -G900 -W36

Then you'd just need to schedule it to start at 08:00, and it should finish on its own at 17:00. As pointed out above, you'll want to wrap it in a small script for the date handling and to log the output.