While I am trying to work using separate files and changed prefix for each instance trying to pursue mergecap approach, I notice that only 1 file ( last prefix named instance ) gets written.
I see 3 netsniff-ng processes when I start it in top as well as in ps aux : sudo nohup /usr/local/sbin/netsniff-ng --fanout-group 1 --fanout-type hash --fanout-opts defrag --ring-size 128MiB --bind-cpu 18 --notouch-irq --silent --in eth5 --out /mnt/sdb1/netcapture/ --prefix "eth50." --interval 60sec & sudo nohup /usr/local/sbin/netsniff-ng --fanout-group 1 --fanout-type hash --fanout-opts defrag --ring-size 128MiB --bind-cpu 20 --notouch-irq --silent --in eth5 --out /mnt/sdb1/netcapture/ --prefix "eth51." --interval 60sec & sudo nohup /usr/local/sbin/netsniff-ng --fanout-group 1 --fanout-type hash --fanout-opts defrag --ring-size 128MiB --bind-cpu 22 --notouch-irq --silent --in eth5 --out /mnt/sdb1/netcapture/ --prefix "eth52." --interval 60sec & $ ps aux | grep netsniff-ng root 2286 0.0 0.0 43312 1672 pts/0 S 18:47 0:00 sudo nohup /usr/local/sbin/netsniff-ng --fanout-group 1 --fanout-type hash --fanout-opts defrag --ring-size 128MiB --bind-cpu 18 --notouch-irq --silent --in eth5 --out /mnt/sdb1/netcapture/ --prefix eth50. --interval 60sec root 2287 0.0 0.0 43312 1676 pts/0 S 18:47 0:00 sudo nohup /usr/local/sbin/netsniff-ng --fanout-group 1 --fanout-type hash --fanout-opts defrag --ring-size 128MiB --bind-cpu 20 --notouch-irq --silent --in eth5 --out /mnt/sdb1/netcapture/ --prefix eth51. --interval 60sec root 2288 0.0 0.0 43312 1672 pts/0 S 18:47 0:00 sudo nohup /usr/local/sbin/netsniff-ng --fanout-group 1 --fanout-type hash --fanout-opts defrag --ring-size 128MiB --bind-cpu 22 --notouch-irq --silent --in eth5 --out /mnt/sdb1/netcapture/ --prefix eth52. --interval 60sec root 2289 2.9 0.8 226492 210060 pts/0 SL 18:47 0:07 /usr/local/sbin/netsniff-ng --fanout-group 1 --fanout-type hash --fanout-opts defrag --ring-size 128MiB --bind-cpu 18 --notouch-irq --silent --in eth5 --out /mnt/sdb1/netcapture/ --prefix eth50. --interval 60sec root 2290 3.3 0.8 226492 210060 pts/0 SL 18:47 0:08 /usr/local/sbin/netsniff-ng --fanout-group 1 --fanout-type hash --fanout-opts defrag --ring-size 128MiB --bind-cpu 20 --notouch-irq --silent --in eth5 --out /mnt/sdb1/netcapture/ --prefix eth51. --interval 60sec root 2291 2.8 0.8 226492 210060 pts/0 SL 18:47 0:06 /usr/local/sbin/netsniff-ng --fanout-group 1 --fanout-type hash --fanout-opts defrag --ring-size 128MiB --bind-cpu 22 --notouch-irq --silent --in eth5 --out /mnt/sdb1/netcapture/ --prefix eth52. --interval 60sec But I see only eth52.epoch.pcap written : -rw-r--r-- 1 root root 251M Apr 30 18:49 /mnt/sdb1/netcapture/eth52.1430419680.pcap -rw-r--r-- 1 root root 272M Apr 30 18:50 /mnt/sdb1/netcapture/eth52.1430419740.pcap -rw-r--r-- 1 root root 245M Apr 30 18:51 /mnt/sdb1/netcapture/eth52.1430419800.pcap -rw-r--r-- 1 root root 214M Apr 30 18:52 /mnt/sdb1/netcapture/eth52.1430419860.pcap -rw-r--r-- 1 root root 57M Apr 30 18:52 /mnt/sdb1/netcapture/eth52.1430419920.pcap Am I doing something wrong ? Regards Ivan -- You received this message because you are subscribed to the Google Groups "netsniff-ng" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
