# Write in realtime packets captured by Bro

**URL:** <https://community.zeek.org/t/write-in-realtime-packets-captured-by-bro/5593>\
**Category:** Zeek\
**Created:** [January 23, 2019, 2:06pm UTC](https://community.zeek.org/t/write-in-realtime-packets-captured-by-bro/5593 "2019-01-23T14:06:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![clopmz](https://avatars.discourse-cdn.com/v4/letter/c/ebca7d/32.png) [@clopmz](https://community.zeek.org/u/clopmz)\
**Post date:** [January 23, 2019, 2:06pm UTC](https://community.zeek.org/t/write-in-realtime-packets-captured-by-bro/5593/1 "2019-01-23T14:06:03Z")

</div>

Hi all,

I am reading Bro's docs about how to write pcap file by Bro. According to docs, passing "-w" switch to bro via BroArgs options, will write a tcpdump file. That is perfect for what I am looking for, but: is it possible to rotate this tcpdump's file and remove it based on disk space and number of files?

Regards,  
C. L. Martinez

---

<div class="post-metadata">

**Author:** ![seth](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/seth/32/642_2.png) [@seth](https://community.zeek.org/u/seth)\
**Post date:** [January 23, 2019, 6:03pm UTC](https://community.zeek.org/t/write-in-realtime-packets-captured-by-bro/5593/2 "2019-01-23T18:03:05Z")

</div>

Unfortunately that hasn't been implemented yet.

&nbsp;&nbsp;&nbsp;.Seth

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/write-in-realtime-packets-captured-by-bro/5593/3 "2022-05-06T15:46:18Z")

</div>