#! /bin/zsh -
del=10
rm -f /mnt/md0/capture/DCN/*.pcap(D.Om[1,$del])
That's using zsh globbing qualifiers:
D: includes hidden files (Dot files).
.: only regular files (like find's -type f)
Om: reverse Order on the age (based on modification time)
[1,$del]: only include the first $del files.
With GNU tools:
cd /mnt/md0/capture/DCN/ &&
find . -maxdepth 1 -name '*.pcap' -type f -printf '%T@@%p\0' |
sort -zn | sed -z "s/[^@]*@//;$del q" | xargs -r0 rm -f
find builds a NUL delimited list of filenames with a Unix timestamp prepended (like 1390682991.0859627500@./file) which is sorted by sort. sed removes the timestamp and quits after reading $del records. That's passed as arguments to rm using xargs -r0.
or:
cd /mnt/md0/capture/DCN/ &&
find . -maxdepth 1 -name '*.pcap' -type f -printf '%T@@%p\0' |
tr '\0\n' '\n\0' | sort -n | head -n "$del" |
cut -d@ -f2- | tr '\0\n' '\n\0' | xargs -r0 rm -f
Same, except that we're using cut to remove the timestamp and head to select the first $del lines. Because GNU cut and head don't support a -z to work on NUL delimited records, we use tr to swap the newline and NUL characters before and after feeding the data to them.
tail -$del? If you could replace that with another condition thatfindsupports (for example delete all files that are older than n minutes/hours/days old), this would be solvable with a purefind ... -delete.dumpcapalso has provision to create a cyclic traffic dump.