I have external hardware that continuously sends UDP data segments over a specified port. I would like to continuously store the last few received packets in a file (could also be time-based).

If I use tcpdump with -G or -C, then either a new file is created, or the old one overwritten after the limit is reached. However, this is not what I need. I would like to have a single file that rotates continuously: as a new packet comes in, the oldest packet should be removed to make space for the new one.

This way I know I will always (after the buffer fills, of course) have a large enough sample (and not of a random size between 0 and N packets/bytes/seconds).

After some web searching, I've found that there used to be a tool called pcapture that used a circular buffer to achieve something similar, but it was short-lived and not even supported under Linux.

What would be the best approach with modern tools to achieve such circularity?

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 12, 2017 at 5:33

2 Answers 2


When you think about it, creating a circular buffer within an on-disk file is pretty complex, and not suited at all to typical disk I/O. The only way to make it even marginally feasible is to find a way to write fixed-length entries to the file, which doesn't sound like it would be a good match for a packet trace.

As suggested above, I would instead use the ringbuffer feature in tshark to create several files which the capture will use in turn. If you specify creating N files (5 to 10 would seem reasonable to me), and tell tshark to rotate after a fixed amount T of time, you will have a reasonable number of log files, an assurance that they won't accumulate over time, and easy access to something between (N-1)*T and N*T minutes of packets.

Per the tshark manual, you would need to use the -b option like so to get 6 files of 2 minutes worth of logs each (note that -b must be specified twice)

-b duration:120 -b files:6

If you need to view the whole capture in one go, you can then use the mergecap utility to merge the N logfiles into one large one to work with in Wireshark.


wireshark for supports circular logging and circular buffering. If you wanting one line of trace for a port to generate a new file then you are going to make the file size setting super small. Not sure what the minimum support file size is. Would have to set the wireshark to filter down to only capturing the desired port. That part is not hard.

I would imagine it can be done with some experimenting. Too board a subject for this post.

www.wireshark.org. Most linux repositories have wireshark available for download.

If it's a headless server then it will be more work to get the start config tweaked with the right parameters.

Good luck.

  • Could you point to the right arguments of tshark that you have in mind (I assume that's what you're suggesting to use, I can't use a GUI)? I don't think tshark with a -b argument does what I've described (a single file that is not completely emptied on rotation).
    – naktinis
    Sep 1, 2015 at 17:49
  • 1
    Your asking for detail that is best asked here. forums.meulie.net/c/wireshark-forum This is the best forum for wireshark questions like the level of detail you are asking for. This forum here is for network engineering.
    – bsulli
    Sep 1, 2015 at 18:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.