run tcpdump in daemon mode

/usr/lib/systemd/system/tcpdumpd.service

[Unit]
After=network.target

[Service]
Restart=always
RestartSec=30
Environment="TCPDUMP_FORMAT=%%Y-%%m-%%d__%%H-%%M"
ExecStartPre=/bin/mkdir -p /var/log/tcpdumpd/
ExecStart=/sbin/tcpdump -i eth0 port 5060 -G 1800 -s 65535 -w '/var/log/tcpdumpd/sipdump_${TCPDUMP_FORMAT}.pcap'
ExecStop=/bin/kill -s QUIT $MAINPID

[Install]
WantedBy=multi-user.target

/etc/logrotate.d/tcpdumpd

/var/log/tcpdumpd/*.pcap {
        daily
        missingok
        rotate 30
        compress
        notifempty
}

Leave a Reply

Your email address will not be published.

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>