Hi all
I got a switch that I would like to do tcpdump on. Because randomly this switch experiences flooding and the storm protection shuts down the corresponding port. But none of our logs gives us sufficient information beyond that it happens.
So I want to do a tcpdump on the relevant ports. I know I can do the following:
monitor traffic interface xxxxx write-file /var/tmp/file.pcap
but that is limited by the space avaliable on /var/tmp.
Is there a way to specifiy how to make the write-file overwrite existing data? The idea is to just let it overwrite the same old file until we detect the flooding again. after which we can manually log in to stop the writing.