---
name: "pcapdump"
section: "1"
platform: "linux"
package: "pcaputils"
version: "0.8-2"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/pcapdump"
---

# pcapdump(1)

dedicated packet capture utility

## NAME

pcapdump - dedicated packet capture utility

## SYNOPSIS

FC**pcapdump**F\[0\]  \[*OPTIONS*\]...

## DESCRIPTION

**pcapdump** captures packets from a network interface and writes them to a dumpfile. The filename argument given to FC**-w**F\[0\] will be formatted by FC**[strftime(3)](/strftime/3.md)**F\[0\].

## PCAPNET OPTIONS

- FC**-i** F\[0\]*interface*

  Input interface to read packets from.

- FC**-r** F\[0\]*pcap file*

  Dump file to read packets from.

- FC**-w** F\[0\]*pcap file*

  Dump file to write filtered packets to.

- FC**-f** F\[0\]*expression*

  BPF expression which selects packets to be filtered.

- FC**-s** F\[0\]*snaplen*

  Capture *snaplen* bytes of data from each packet.

- FC**-p**F\[0\]

  Disable promiscuous mode sniffing.

## PROGRAM OPTIONS

- FC**-u** F\[0\]*owner*

  Set the output file's owning user to *owner*.

- FC**-g** F\[0\]*group*

  Set the output file's owning group to *group*.

- FC**-m** F\[0\]*mode*

  Set the output file's mode to *mode*, specified in octal.

- FC**-t** F\[0\]*secs*

  Dump file rotation interval in seconds.

- FC**-c** F\[0\]*count*

  Exit after capturing *count* packets.

- FC**-T** F\[0\]*secs*

  Exit after capturing during this amount of seconds.

- FC**-H** F\[0\]

  Only capture link, network, and transport headers; do not capture application-layer data.

- FC**-S** F\[0\]*sample value*

  Sample the packet stream by only dumping 1 in every *sample value* packets.

- FC**-R** F\[0\]

  Together with -S, sample the packets randomly, not systematically.

- FC**-P** F\[0\]*pidfile*

  Daemonize the process and write its PID to *pidfile*.

- FC**-C** F\[0\]*config file*

  File to read configuration variables from. Instead of passing configuration through the command line, a file can be used to specify values for the FC**bpf**F\[0\], FC**device**F\[0\], FC**filefmt**F\[0\], FC**group**F\[0\], FC**interval**F\[0\], FC**mode**F\[0\], FC**owner**F\[0\], FC**promisc**F\[0\], and FC**snaplen**F\[0\] options (not all need to be specified; defaults will be used otherwise). See /usr/share/doc/pcaputils/examples/pcapdump/eth0 for an example.