Q:

Linux Full Packet Capture

I’m looking to stand up a full packet capture solution on an Ubuntu server.  Our maximum bandwidth is < 60Mb/s and the server has 10K hard drives. 
Ideally, I’d like to be able to log everything directly to a pcap file that rotates to a new file daily. Having the ability to remove pcap files that have exceeded a given time period or space threshold (i.e. Over 30 days old or exceeding 90% of the maximum storage space) would also been incredibly advantageous. 
I’ve looked into OpenFPC, but development seems to have come to a complete halt. No new editions have been released in well over 2 years; otherwise, that would fit the bill just fine.
SANS has a in-depth tutorial on how to setup tcpdump for this, but the system doesn’t really allow for a way to remove old files.
What is the best solution for running full packet captures on a linux server for an enterprise network?

A:

You might want to be using tshark for this instead of tcpdump.  Tshark uses the same pcap format but it has much better options for continuous logging.
One option is the tshark ring-buffer mode.

-b  Cause TShark to run in "multiple files" mode. In "multiple files" mode, TShark will write to several
  capture files. When the first capture file fills up, TShark will
  switch writing to the next file and so on.
The created filenames are based on the filename given with the -w
  option, the number of the file and on the creation date and time, e.g.
  outfile_00001_20050604120117.pcap, outfile_00002_20050604120523.pcap,
  ...

