NAME
pcapdump - dedicated packet capture utility
SYNOPSIS
FCpcapdumpF[0] [OPTIONS]...
DESCRIPTION
pcapdump captures packets from a network interface and writes them to a dumpfile. The filename argument given to FC-wF[0] will be formatted by FCstrftime(3)F[0].
PCAPNET OPTIONS
- FC-i F[0]interface
-
Input interface to read packets from.
- FC-r F[0]pcap file
-
Dump file to read packets from.
- FC-w F[0]pcap file
-
Dump file to write filtered packets to.
- FC-f F[0]expression
-
BPF expression which selects packets to be filtered.
- FC-s F[0]snaplen
-
Capture snaplen bytes of data from each packet.
- FC-pF[0]
-
Disable promiscuous mode sniffing.
PROGRAM OPTIONS
- FC-u F[0]owner
-
Set the output file's owning user to owner.
- FC-g F[0]group
-
Set the output file's owning group to group.
- FC-m F[0]mode
-
Set the output file's mode to mode, specified in octal.
- FC-t F[0]secs
-
Dump file rotation interval in seconds.
- FC-c F[0]count
-
Exit after capturing count packets.
- FC-T F[0]secs
-
Exit after capturing during this amount of seconds.
- FC-H F[0]
-
Only capture link, network, and transport headers; do not capture application-layer data.
- FC-S F[0]sample value
-
Sample the packet stream by only dumping 1 in every sample value packets.
- FC-R F[0]
-
Together with -S, sample the packets randomly, not systematically.
- FC-P F[0]pidfile
-
Daemonize the process and write its PID to pidfile.
- FC-C F[0]config file
-
File to read configuration variables from. Instead of passing configuration through the command line, a file can be used to specify values for the FCbpfF[0], FCdeviceF[0], FCfilefmtF[0], FCgroupF[0], FCintervalF[0], FCmodeF[0], FCownerF[0], FCpromiscF[0], and FCsnaplenF[0] options (not all need to be specified; defaults will be used otherwise). See /usr/share/doc/pcaputils/examples/pcapdump/eth0 for an example.