pcapdump1

Usage

Overview

pcapdump captures packets from a network interface and writes them to a dumpfile. The filename argument given to FC-wF[0] will be formatted by FCstrftime(3)F[0].

Options

FC-i F[0]interface

Input interface to read packets from.

FC-r F[0]pcap file

Dump file to read packets from.

FC-w F[0]pcap file

Dump file to write filtered packets to.

FC-f F[0]expression

BPF expression which selects packets to be filtered.

FC-s F[0]snaplen

Capture snaplen bytes of data from each packet.

FC-pF[0]

Disable promiscuous mode sniffing.

Options

FC-u F[0]owner

Set the output file's owning user to owner.

FC-g F[0]group

Set the output file's owning group to group.

FC-m F[0]mode

Set the output file's mode to mode, specified in octal.

FC-t F[0]secs

Dump file rotation interval in seconds.

FC-c F[0]count

Exit after capturing count packets.

FC-T F[0]secs

Exit after capturing during this amount of seconds.

FC-H F[0]

Only capture link, network, and transport headers; do not capture application-layer data.

FC-S F[0]sample value

Sample the packet stream by only dumping 1 in every sample value packets.

FC-R F[0]

Together with -S, sample the packets randomly, not systematically.

FC-P F[0]pidfile

Daemonize the process and write its PID to pidfile.

FC-C F[0]config file

File to read configuration variables from. Instead of passing configuration through the command line, a file can be used to specify values for the FCbpfF[0], FCdeviceF[0], FCfilefmtF[0], FCgroupF[0], FCintervalF[0], FCmodeF[0], FCownerF[0], FCpromiscF[0], and FCsnaplenF[0] options (not all need to be specified; defaults will be used otherwise). See /usr/share/doc/pcaputils/examples/pcapdump/eth0 for an example.