Tcpdump Script - gdump

gdump

#! /bin/bash

# Usage: 
# Start record: sudo gdump start
# Stop record : sudo gdump stop 
#
# The cap file is under /tmp/HOSTNAME.cap
#
# Prerequire: tcpdump
#   Ubuntu: sudo apt-get install tcpdump
#   Centos: sudo yum install tcpdump
#
# sudo mv /path/to/gdump /usr/bin/gdump
# sudo chmod +x /usr/bin/gdump
#
#

# Change this to the network interface you want to record
INTERFACE='eth0'

if [ "$USER" != 'root' ];then
  echo "Please run with sudo"
  exit
fi

pid=$(ps -e | pgrep tcpdump || echo "NOTFOUND")

if [ "$1" == "start" ];then
  if [ "$pid" == "NOTFOUND" ];then
    nohup tcpdump -U -i "${INTERFACE}" -nn -w "/tmp/$(hostname).cap" &
    echo "Start recording to /tmp/..."
  else
    echo "gdump has started..."
  fi
elif [ "$1" == "stop" ];then
  if [ "$pid" == "NOTFOUND" ];then
    echo "gdump has not stared..."
  else
    kill -2 $pid
    echo "Stop recording..."
  fi
else
  echo "Usage:"
  echo "    Start record: sudo gdump start"
  echo "    Stop record : sudo gdump stop"
fi