Bug ID 1028033: Tcpdump capture file can fill the /var/F5/partition.

Last Modified: Oct 20, 2022

Bug Tracker

Affected Product:  See more info
F5OS Velos(all modules)

Fixed In:
1.2.0

Opened: Jun 22, 2021
Severity: 3-Major

Symptoms

Tcpdump capture files are located at /var/F5/partition. As captures grow in size, these may use up all the space on /var/F5/partition, starving other components that want to use this storage.

Impact

/var/F5/partition may run out of space, and other components that need space might error

Conditions

Tcpdump has to be started with a capture to file ( "-w") option

Workaround

None

Fix Information

This fix does the following: - If started with the "-w" option, the pcap file size is limited to: available space in /var/F5/partition - 2GB - If there is less than 2GB, tcpdump will throw an error ("ERROR: Only ... 1K blocks available in /var/F5/partition. Need atleast ... 1K blocks of free space.") and not start the tcpdump session - If there is less than 100MB, tcpdump will print a "WARNING__Capture_file_size_will_be_limited_to_97216_1K_blocks)" - If the space is less than 1 MB, tcpdump will fail. Explicit -C option can be used to override

Behavior Change