http://e26whn2524322mkxb3cbyk27ev2ihhq2biz35hty7gzgsyrwrygq27yd.onion/posts/blog/security/digging-into-the-behaviour-of-a-self-authenticating-mastodon-scraper-bot.html
Initially, I had intended to run a rolling packet capture with tcpdump 's -G option, but I ran into AppArmour related issues and was running out of time, so implemented the rotation myself: #!/bin/bash
cd /mnt/bigvol
captures=`ls -1 *.pcap`
killall -15 tcpdump
bash -c "nohup /usr/sbin/tcpdump -i any -s0 -w /mnt/bigvol/masto.`date +'%Y-%m-%dT%H.%M.%SZ'`.pcap port 3000 &"
for capture in $captures
do
gzip $capture
done This was added to cron and scheduled to run hourly 0 * * * *...