Filesystem writes seemingly lost

view full story

http://unix.stackexchange.com – I've been experimenting with tcpdump, and I've found some very bizarre filesystem behavior. It doesn't look to be a tcpdump problem as I'll explain in a second. The following command produces no file: tcpdump -w test.pcap Yet this command produces the PCAP file as expected: tcpdump -w - > test.pcap At first I figured that tcpdump must be encountering some error when writing the file that the shell wasn't, so I straced and found that the writes were occurring just fine! open("test.pcap", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 4 fstat(4, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0 mmap( (HowTos)