Forum Discussion

Martin_Kaiser_1's avatar
Martin_Kaiser_1
Icon for Nimbostratus rankNimbostratus
Jul 19, 2011

Running long-living tcpdumps on BigIP

Hi guys,

 

 

I'm not quite sure if this is the right forum to post the question, but I couldn't find a more suitable one...

 

 

I often need the possibility to monitor specific client connections to virtual servers for a long time (in order to capture sporadic errors). tcpdump on the BigIp comes in very handy, although its major drawback is that you need to keep open the SSH connection to the Big IP all the time, which is not possible for me in most cases (especially when waiting for an reoccurring error many hours or even several days).

 

On a "normal" linux system, I would use 'screen' in order to make any program run in the background even after disconnecting from the host. Unfortunately, screen is not available on BigIP systems. Furthermore, I'm having concerns regarding performance when running tcpdump in the background for a long time.

 

Anybody here with a good idea how to cope with such issues? Any shared experience is appreciated. Thanks a lot in advance!

 

 

Greetings

 

Martin

 

config
design

10 Replies

Sort By
  • Hamish's avatar
    Hamish
    Icon for Cirrocumulus rankCirrocumulus
    Jul 19, 2011
    screen? Never used it.

     

     

    The best (Gold plated) way would probably be to setup a service. Then you can start it with 'services xxx (start|stop|status), and use chkconfig to enable/disable the auto running of the service on boot. That may be more than you need.

     

     

    If you're happy to kick off the tcpdump manually, use nohup, and kick the task off in the background (With &). e.g.

     

     

    nohup tcpdump -i -s 2000 -w /var/tmp/mydumpfile -C "filter" &

     

     

    That'll run a copy of tcpdump, detatched in the background, and nohup will ensure that when you logout, it won't get a hang-up signal... So it'll basically run forever. And will roll the dumpfile over to a new one when it reaches MB (That's decimal millions, not ^2).

     

     

     

    That leaves you with one problem... Number of files... I've seen versions of tcpdump that'll let you specify a number of files to keep, but I don't think LTM's tcpdump does that. So you either want to run a small job in under cron to clean-up, or use a script to kickoff tcpdump AND cleanup files... If you don't mind losing a few packets between files, you could also run tcpdump in a loop (From a script - Or from direct typing if you're confident :), with -c , it'll exit after packets, and you can cleanup and run another copy of tcpdump...

     

     

    6 of one... Half dozen of the other... There'll be a few more ways to skin the cat too... That's Unix for you :) I love it...

     

     

    YMMV...

     

     

    No cats were harmed in the typing of this email...

     

     

    :)

     

     

    H

     

  • Hamish's avatar
    Hamish
    Icon for Cirrocumulus rankCirrocumulus
    Jul 19, 2011
    Apologies... The website seems to have removed a few words... The actual command should be 

    nohup tcpdump -i  -s 2000 -w /var/tmp/mydumpfile -C  "filter" &

    H
  • Hamish's avatar
    Hamish
    Icon for Cirrocumulus rankCirrocumulus
    Jul 19, 2011
    Sigh... And even code protected blocks don't seem to be immune...

     

  • Hamish's avatar
    Hamish
    Icon for Cirrocumulus rankCirrocumulus
    Jul 19, 2011
    Doh! I lie!!!

    tcpdump on BigIP DOES have the limit on the number of files... Use the -W count option... Making the command 

    nohup tcpdump -i interface -s 2000 -w /var/tmp/mydumpfile -C size -W filecount "filter" &

    (I've left out the problematic angle brackets this time... Only the ampersand is a challenge for me now 🙂

    H
  • RiverFish's avatar
    RiverFish
    Icon for Altostratus rankAltostratus
    Nov 20, 2014

    Is it possible to create a cron job to run that command at a specific time?

     

  • Hamish's avatar
    Hamish
    Icon for Cirrocumulus rankCirrocumulus
    Nov 20, 2014

    Sure is... Just add an entry into the crontab file for the user you want to run it. or put it in a more complex script and just call the script.

     

    H

     

  • RiverFish_95049's avatar
    RiverFish_95049
    Icon for Nimbostratus rankNimbostratus
    Nov 21, 2014

    Unfortunately I've never created a cron job, could you break it down for me please? Let's say I wanted the tcpdump job to kick off at 10:30 PM and run until 3:00 AM.

     

    • nitass's avatar
      nitass
      Icon for Employee rankEmployee
      Nov 23, 2014
      >Unfortunately I've never created a cron job Schedule Tasks on Linux Using Crontab http://kvz.io/blog/2007/07/29/schedule-tasks-on-linux-using-crontab/ it is just tcpdump and killall commands. you are aware that W option will overwrite old file, aren't you? e.g. [root@ve11a:Active:In Sync] config crontab -l cron tab for root 1-59/10 * * * * /usr/bin/diskmonitor MAILTO="" 51 * * * * /usr/bin/copy_rrd save 27 21 * * * /usr/sbin/tcpdump -nni 0.0:nnn -s0 -C 1 -W 10 -w /var/tmp/test 30 21 * * * killall tcpdump [root@ve11a:Active:In Sync] config ls -l /shared/tmp/|grep test -rw-r--r-- 1 pcap pcap 1000011 Nov 23 21:29 test0 -rw-r--r-- 1 pcap pcap 1000028 Nov 23 21:29 test1 -rw-r--r-- 1 pcap pcap 1000171 Nov 23 21:29 test2 -rw-r--r-- 1 pcap pcap 710416 Nov 23 21:30 test3 -rw-r--r-- 1 pcap pcap 1000020 Nov 23 21:29 test4 -rw-r--r-- 1 pcap pcap 1000147 Nov 23 21:29 test5 -rw-r--r-- 1 pcap pcap 1000119 Nov 23 21:29 test6 -rw-r--r-- 1 pcap pcap 1000237 Nov 23 21:29 test7 -rw-r--r-- 1 pcap pcap 1000086 Nov 23 21:29 test8 -rw-r--r-- 1 pcap pcap 1000256 Nov 23 21:29 test9
  • RiverFish's avatar
    RiverFish
    Icon for Altostratus rankAltostratus
    Nov 21, 2014

    Unfortunately I've never created a cron job, could you break it down for me please? Let's say I wanted the tcpdump job to kick off at 10:30 PM and run until 3:00 AM.

     

    • nitass's avatar
      nitass
      Icon for Employee rankEmployee
      Nov 23, 2014
      >Unfortunately I've never created a cron job Schedule Tasks on Linux Using Crontab http://kvz.io/blog/2007/07/29/schedule-tasks-on-linux-using-crontab/ it is just tcpdump and killall commands. you are aware that W option will overwrite old file, aren't you? e.g. [root@ve11a:Active:In Sync] config crontab -l cron tab for root 1-59/10 * * * * /usr/bin/diskmonitor MAILTO="" 51 * * * * /usr/bin/copy_rrd save 27 21 * * * /usr/sbin/tcpdump -nni 0.0:nnn -s0 -C 1 -W 10 -w /var/tmp/test 30 21 * * * killall tcpdump [root@ve11a:Active:In Sync] config ls -l /shared/tmp/|grep test -rw-r--r-- 1 pcap pcap 1000011 Nov 23 21:29 test0 -rw-r--r-- 1 pcap pcap 1000028 Nov 23 21:29 test1 -rw-r--r-- 1 pcap pcap 1000171 Nov 23 21:29 test2 -rw-r--r-- 1 pcap pcap 710416 Nov 23 21:30 test3 -rw-r--r-- 1 pcap pcap 1000020 Nov 23 21:29 test4 -rw-r--r-- 1 pcap pcap 1000147 Nov 23 21:29 test5 -rw-r--r-- 1 pcap pcap 1000119 Nov 23 21:29 test6 -rw-r--r-- 1 pcap pcap 1000237 Nov 23 21:29 test7 -rw-r--r-- 1 pcap pcap 1000086 Nov 23 21:29 test8 -rw-r--r-- 1 pcap pcap 1000256 Nov 23 21:29 test9