Yeah, it doesn't seem to work as MariusMatutiae's answer says.
tcpdump ...{other options}... -w httpdebug.pcap -W 48 -G 1800 -C 100
$ ls -l
-rw-r--r--. 1 tcpdump tcpdump 100007441 Mar 17 17:57 httpdebug.pcap00
-rw-r--r--. 1 tcpdump tcpdump 46895104 Mar 17 18:02 httpdebug.pcap01
-rw-r--r--. 1 tcpdump tcpdump 93091143 Mar 17 17:47 httpdebug.pcap02
-rw-r--r--. 1 tcpdump tcpdump 5372072 Mar 17 16:17 httpdebug.pcap03
It looks to me like it might be capturing as many -C 100
MB files as possible in a 30 minute period because httpdebug.pcap03
has the earliest timestamp and it's a lot smaller than 100MB, so it seems like it was cut at a 30 minute mark. Once it hits 30 mins, it seems to jump back to httpdebug.pcap00
and increment the number as it hits 100MB. This means that if you have a lot of requests in a 30 minute period, you get to very high httpdebug.pcapXX numbers. If you never reach that many requests in a period anymore, those high httpdebug.pcapXX numbers won't ever get overwritten.
So I'm thinking cyclical files per timeslice means that the timeslice is -G 1800
and it will cycle every -G 1800
and increment every -C 100
.
I'm not sure if -W 48
affects it, but perhaps if you get to httpdebug.pcap47
(count starts at 0`, it will stop capturing packets.
Somewhat recently, there was a GitHub issue opened about the confusing wording. They did not change the implementation, but they tried to make the documentation a little bit clearer.
The proposed changes were merged in on Jan 28, 2019.
As of today, March 17, 2019, here is the current documentation:
-C
:
.BI \-C " file_size"
Before writing a raw packet to a savefile, check whether the file is
currently larger than \fIfile_size\fP and, if so, close the current
savefile and open a new one. Savefiles after the first savefile will
have the name specified with the
.B \-w
flag, with a number after it, starting at 1 and continuing upward.
The units of \fIfile_size\fP are millions of bytes (1,000,000 bytes,
not 1,048,576 bytes).
-G
:
.BI \-G " rotate_seconds"
If specified, rotates the dump file specified with the
.B \-w
option every \fIrotate_seconds\fP seconds.
Savefiles will have the name specified by
.B \-w
which should include a time format as defined by
.BR strftime (3).
If no time format is specified, each new file will overwrite the previous.
Whenever a generated filename is not unique, tcpdump will overwrite the
preexisting data; providing a time specification that is coarser than the
capture period is therefore not advised.
.IP
If used in conjunction with the
.B \-C
option, filenames will take the form of `\fIfile\fP<count>'.
-W
:
.B \-W
Used in conjunction with the
.B \-C
option, this will limit the number
of files created to the specified number, and begin overwriting files
from the beginning, thus creating a 'rotating' buffer.
In addition, it will name
the files with enough leading 0s to support the maximum number of
files, allowing them to sort correctly.
.IP
Used in conjunction with the
.B \-G
option, this will limit the number of rotated dump files that get
created, exiting with status 0 when reaching the limit.
.IP
If used in conjunction with both
.B \-C
and
.B \-G,
the
.B \-W
option will currently be ignored, and will only affect the file name.
I still think it's a little confusing, but I guess the difference from my conclusion above, is that it says -W
when used with -C -G
does not affect anything but the file name.
In general, -W
is used for limiting the number of files. So don't use it if you want to capture indefinitely.