philologist's techblog

cron job:

# start tcpdump each hour from 8:00 to 20:00 daily
00 8-20 * * * root      /var/scripts/tcpdumper.sh

tcpdumper.sh script:

#!/bin/bash

TCPDUMP="/usr/bin/timeout 1h /usr/sbin/tcpdump -v -As0 -pnni enp2s0 udp and net 10.72.1.0/24 or net 10.72.2.0/24 or host 1.2.3.4"
DATE=$(date +%F_%T)

cd /home/user/
$TCPDUMP -w $DATE.pcap

# remove older than 5 days old dumps
find /home/user/ -type f -name "*pcap" -mtime +5 -execdir rm -f {} \;

exit $?