PCAP gathering To get pcap files for IP <ip> in <seconds> chunks with limit of maximum <files_number> files to not eat all disk space: sudo tcpdump -W <files_number> -Z root -n -s0 -G <seconds> -i <interface> -w <some_name>.%Y-%m-%d.%H:%M:%S.pcap host <ip>