title: Perl script to capture tcpdump traces on Linux
body: <p>Hi I have written a script, which was working fine previously with 'snoop' commands. This script forks child in the script to start tcpdump. When i have to stop the dump I kill the child but when i look at the pcap generated in wireshark, it shows the error "The capture file appears to have been cut short in the middle of a packet". My commands are</p>
  
  <pre><code>my $snoopAPP = &amp;startService("tcpdump -w /tmp/app.pcap -i bond0&gt;/dev/null 2&gt;&amp;1" , '');
  kill 9, -$snoopAPP;waitpid $snoopAPP, 0;
  
  sub startService(){
      #runs a program in background and returns PID which can be used later to kill the process
      #arguments are 1, path , 2nd the name of the file
      my $processPath = $_[0];chomp($processPath);
      if ($_[1] ne ''){$processPath = $processPath . " &gt;$path/$_[1].log";}
      print "\nStarting ... \n-- $processPath\n";
      my $pid = fork();
      die "unable to fork $processPath: $!" unless defined($pid);
      if (!$pid) {  # child
          setpgrp(0, 0);
        exec("$processPath");
        die "\nunable to exec: $!\n";
        exit;
      }
      print " ---- PID: $pid\n";
      return $pid;
  }
  </code></pre>
  
  <p>Another post suggests to wait for tcpdump to exit, which I am doing already, but still it results in the same error message.</p>