MTP creates packet capture (pcap) files on the ramdisk, nqtmp/tim. However, unless the process is stopped, the pcap files are moved elsewhere within milliseconds. Is there a way to save a pcap file without stopping the process?
At the MTP UNIX Console prompt enter something like this
- Watch -n 2 "cp /nqtmp/tim/1/worker*/*.pcap /tmp"
to copy pcap files from all ramdisk worker directories every 2 seconds.
A message will appear on the screen "can't stat the files" because they are already moved out of /nqtmp/tim. Once you stop the command, however, you will see the pcap files in /tmp or any other specified directory.