---
name: "nsntrace"
section: "1"
platform: "linux"
package: "nsntrace"
version: "4-1+b1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/nsntrace"
---

# nsntrace(1)

Perform a network trace of a process by using Linux network namespaces

## NAME

nsntrace - Perform a network trace of a process by using Linux network namespaces

## SYNOPSIS

**nsntrace** \[options\] *program* \[arguments\]

## DESCRIPTION

**nsntrace** uses Linux network namespaces to perform network traces of the specified *program*. The traces are stored as pcap files. And can later be analyzed by applications such as **wireshark**.

**nsntrace** creates a new network namespace and launches the specified *program* in it. This will ensure that all the packets we trace come from the system or the specified *program*.

To get around the isolation caused by the network namespace a virtual network interface is created. And in order for the *program* network traffic to reach the root network namespace **iptables** is used.

Since **nsntrace** uses iptables and traces raw sockets it needs to be run as root.

## OPTIONS

The following options are understood:

- **--device** *dev*, **-d** *dev*

  The network device to use in trace.

- **--use-public-dns**

  Override resolv.conf in namespace to use public nameservers from Quad9 (9.9.9.9), Cloudflare (1.1.1.1), Google (8.8.8.8) and OpenDNS (208.67.222.222).

- **--outfile** *file*, **-o** *file*

  Write the trace output to the file *file*. Default is nsntrace.pcap. Use '-' for stdout.

- **--user** *user*, **-u** *user*

  Run program with the user ID, group ID and supplementary groups of *user*.

- **--filter** *filter*, **-f** *filter*

  The capture filter to use while capturing. See [**pcap-filter**(7)](/pcap-filter/7.md) for *filter* syntax.

## EXIT STATUS

On success, 0 is returned; otherwise, a non-zero failure code is returned.

## AUTHOR

**Jonas Danielsson** \<jonas@threetimestwo.org\>

Original author