-w Write the raw packets to file rather than parsing and printing
them out. They can later be printed with the -r option. Stan-
dard output is used if file is ``-''.
This output will be buffered if written to a file or pipe, so a
program reading from the file or pipe may not see packets for an
arbitrary amount of time after they are received. Use the -U
flag to cause packets to be written as soon as they are
received.
The MIME type application/vnd.tcpdump.pcap has been registered
with IANA for pcap files. The filename extension .pcap appears
to be the most commonly used along with .cap and .dmp. Tcpdump
itself doesn't check the extension when reading capture files
and doesn't add an extension when writing them (it uses magic
numbers in the file header instead). However, many operating
systems and applications will use the extension if it is present
and adding one (e.g. .pcap) is recommended.
See pcap-savefile(5) for a description of the file format.
-W Used in conjunction with the -C option, this will limit the num-
ber of files created to the specified number, and begin over-
writing files from the beginning, thus creating a 'rotating'
buffer. In addition, it will name the files with enough leading
0s to support the maximum number of files, allowing them to sort
correctly.
Used in conjunction with the -G option, this will limit the num-
ber of rotated dump files that get created, exiting with status
0 when reaching the limit. If used with -C as well, the behavior
will result in cyclical files per timeslice.
-G If specified, rotates the dump file specified with the -w option
every rotate_seconds seconds. Savefiles will have the name
specified by -w which should include a time format as defined by
strftime(3). If no time format is specified, each new file will
overwrite the previous.
If used in conjunction with the -C option, filenames will take
the form of `file<count>'.
-a
and -b
option to have it write out files of a certain size, and to only write out a specific number of files, and to overwrite the older ones.[/cmd]