Symptoms

Tcpdump does not stop capturing packets when the packet count is set to zero; instead, it continues running indefinitely until it is manually interrupted.

Impact

Prolonged or unintended packet captures can lead to increased resource usage (CPU, memory, and disk), potential log or storage exhaustion, and operational overhead, as administrators must manually detect and stop the capture process.

Conditions

This issue arises when tcpdump is initiated with the packet count parameter set to zero or a value that equates to zero. This leads to the capture process running indefinitely without a natural termination condition.

Workaround

None

Fix Information

Updated tcpdump behavior so that when the packet count is configured as zero, it is handled correctly and no longer causes the capture to run indefinitely. Tcpdump now terminates as expected based on the configured capture limits, preventing unintended long-running captures and excessive resource usage.

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips