tcpdump -C 1 -W 3 -i em0 -w capture.pcap Should produce 3 files of 1,000,000 bytes but it ignores -C 1 and capture.pcap0 just keeps growing in size
pkelsey@ is working on importing a newer tcpdump release which fixes this issue
For posterity, some history at: https://lists.freebsd.org/pipermail/freebsd-current/2014-September/052049.html https://github.com/the-tcpdump-group/tcpdump/commit/887bf88fd058f8c0ef9a5af1a95b43753e3ad2eb
*** Bug 201281 has been marked as a duplicate of this bug. ***
A commit references this bug: Author: pkelsey Date: Wed Jul 8 16:19:37 UTC 2015 New revision: 285275 URL: https://svnweb.freebsd.org/changeset/base/285275 Log: MFV r285191: tcpdump 4.7.4. Also, the changes made in r272451 and r272653 that were lost in the merge of 4.6.2 (r276788) have been restored. PR: 199568 Differential Revision: https://reviews.freebsd.org/D3007 Reviewed by: brooks, hiren Approved by: jmallett (mentor) MFC after: 1 month Changes: _U head/contrib/tcpdump/ head/contrib/tcpdump/CHANGES head/contrib/tcpdump/CREDITS head/contrib/tcpdump/INSTALL.txt head/contrib/tcpdump/Makefile.in head/contrib/tcpdump/VERSION head/contrib/tcpdump/addrtoname.c head/contrib/tcpdump/addrtoname.h head/contrib/tcpdump/bootp.h head/contrib/tcpdump/config.guess head/contrib/tcpdump/config.h.in head/contrib/tcpdump/config.sub head/contrib/tcpdump/configure head/contrib/tcpdump/configure.in head/contrib/tcpdump/extract.h head/contrib/tcpdump/interface.h head/contrib/tcpdump/ip.h head/contrib/tcpdump/machdep.c head/contrib/tcpdump/missing/strsep.c head/contrib/tcpdump/mkdep head/contrib/tcpdump/netdissect.h head/contrib/tcpdump/openflow.h head/contrib/tcpdump/oui.c head/contrib/tcpdump/oui.h head/contrib/tcpdump/print-ahcp.c head/contrib/tcpdump/print-aodv.c head/contrib/tcpdump/print-arcnet.c head/contrib/tcpdump/print-arp.c head/contrib/tcpdump/print-ascii.c head/contrib/tcpdump/print-atm.c head/contrib/tcpdump/print-babel.c head/contrib/tcpdump/print-bgp.c head/contrib/tcpdump/print-bootp.c head/contrib/tcpdump/print-cdp.c head/contrib/tcpdump/print-cfm.c head/contrib/tcpdump/print-chdlc.c head/contrib/tcpdump/print-cnfp.c head/contrib/tcpdump/print-dccp.c head/contrib/tcpdump/print-decnet.c head/contrib/tcpdump/print-eigrp.c head/contrib/tcpdump/print-enc.c head/contrib/tcpdump/print-ether.c head/contrib/tcpdump/print-forces.c head/contrib/tcpdump/print-fr.c head/contrib/tcpdump/print-ftp.c head/contrib/tcpdump/print-geneve.c head/contrib/tcpdump/print-geonet.c head/contrib/tcpdump/print-gre.c head/contrib/tcpdump/print-http.c head/contrib/tcpdump/print-icmp.c head/contrib/tcpdump/print-icmp6.c head/contrib/tcpdump/print-ip.c head/contrib/tcpdump/print-ip6.c head/contrib/tcpdump/print-ipnet.c head/contrib/tcpdump/print-isoclns.c head/contrib/tcpdump/print-juniper.c head/contrib/tcpdump/print-ldp.c head/contrib/tcpdump/print-lldp.c head/contrib/tcpdump/print-lmp.c head/contrib/tcpdump/print-lspping.c head/contrib/tcpdump/print-lwapp.c head/contrib/tcpdump/print-mobility.c head/contrib/tcpdump/print-mpcp.c head/contrib/tcpdump/print-mpls.c head/contrib/tcpdump/print-nflog.c head/contrib/tcpdump/print-null.c head/contrib/tcpdump/print-olsr.c head/contrib/tcpdump/print-openflow-1.0.c head/contrib/tcpdump/print-openflow.c head/contrib/tcpdump/print-ospf.c head/contrib/tcpdump/print-pflog.c head/contrib/tcpdump/print-pim.c head/contrib/tcpdump/print-ppi.c head/contrib/tcpdump/print-ppp.c head/contrib/tcpdump/print-radius.c head/contrib/tcpdump/print-rpki-rtr.c head/contrib/tcpdump/print-rsvp.c head/contrib/tcpdump/print-rtsp.c head/contrib/tcpdump/print-sflow.c head/contrib/tcpdump/print-sip.c head/contrib/tcpdump/print-sl.c head/contrib/tcpdump/print-sll.c head/contrib/tcpdump/print-slow.c head/contrib/tcpdump/print-smb.c head/contrib/tcpdump/print-smtp.c head/contrib/tcpdump/print-tcp.c head/contrib/tcpdump/print-telnet.c head/contrib/tcpdump/print-udp.c head/contrib/tcpdump/print-vxlan.c head/contrib/tcpdump/print-wb.c head/contrib/tcpdump/print-zeromq.c head/contrib/tcpdump/tcp.h head/contrib/tcpdump/tcpdump.1.in head/contrib/tcpdump/tcpdump.c head/contrib/tcpdump/udp.h head/contrib/tcpdump/util.c head/usr.sbin/tcpdump/tcpdump/Makefile head/usr.sbin/tcpdump/tcpdump/config.h head/usr.sbin/tcpdump/tcpdump/tcpdump.1
This does not need to be MFC'd to stable/9 because r268997 (the libc patch that resulted in the tcpdump bug) was not MFC'd to stable/9.
A direct commit of the cherrypicked upstream patches that address this issue is now pending commit approval from re@ for inclusion in the 10.2-BETA3 cycle.
A commit references this bug: Author: pkelsey Date: Sat Jul 18 01:29:28 UTC 2015 New revision: 285665 URL: https://svnweb.freebsd.org/changeset/base/285665 Log: MFC r285275 (only the part that fixes PR 199568): Obtain proper capsicum rights for dump files so rotation of such files works when requested. This is equivalent to cherry picking the following upstream commits: commit c6d472bf63488b0c2ab7ab9f4b32c68dd2c8ea2b commit f08eb851eedf9775e6485ab75c0d8cf8d1306be6 commit d83a284abc80d3d09f6bddd087760bb1b01d9cc7 PR: 199568 Approved by: re Changes: stable/10/contrib/tcpdump/tcpdump.c
This will be fix will appear in the 10.2 release series as of 10.2-BETA3, or if 10.2-BETA3 is not created, then as of 10.2-RC1.