> > I wonder - it would probably be trivial to add support to
> > tethereal/ethereal/tcpdump to have SIGHUP cause the server to close and
> > reopen the capture file.
>
> It might be, although you wouldn't want that to be the *default* SIGHUP
> action - heck, you might want to make it a SIGUSR1 action, instead
> (anything worthy of the name "modern UNIX" should have SIGUSR1).
Of course, this raises the question of whether it *belongs* in Tethereal
and tcpdump, or whether a "capture daemon" program should be written,
instead; it'd be a lot simpler than tcpdump or Tethereal, as it wouldn't
support dissecting packets, it'd just support capturing them and saving
them to a file.
You could, I guess, even get creative and have it support, say, a named
pipe to which you can send it a message containing a file name, which
causes it to start capturing to that new file.
Or you could just have it take, as its "-w" argument, the prefix of the
file name, and take another argument which is how long it should capture
to any particular file, and it could append a date/time stamp to the
name of each file, and do the rotation itself.