tcpdump hourly

cron job:

# start tcpdump each hour from 8:00 to 20:00 daily
00 8-20 * * * root      /var/scripts/tcpdumper.sh

tcpdumper.sh script:

#!/bin/bash

TCPDUMP="/usr/bin/timeout 1h /usr/sbin/tcpdump -v -As0 -pnni enp2s0 udp and net 10.72.1.0/24 or net 10.72.2.0/24 or host 1.2.3.4"
DATE=$(date +%F_%T)

cd /home/user/
$TCPDUMP -w $DATE.pcap

# remove older than 5 days old dumps
find /home/user/ -type f -name "*pcap" -mtime +5 -execdir rm -f {} \;

exit $?

Tags:

This entry was posted on Wednesday, January 28th, 2026 at 22:18 and is filed under Uncategorized. You can follow any responses to this entry through the RSS 2.0 feed. Both comments and pings are currently closed.

Comments are closed.