pcapdump(1)

NAME
pcapdump - dedicated packet capture utility

SYNOPSIS
pcapdump
[OPTIONS]...

DESCRIPTION
pcapdump captures packets from a network interface and writes them to a dumpfile. The filename argument given to \FC-w\F[] will be formated by \FCstrftime(3)\F[].

PCAPNET OPTIONS

\FC-i \F[]interface
    Input interface to read packets from.

\FC-r \F[]pcap file
    Dump file to read packets from.

\FC-w \F[]pcap file
    Dump file to write filtered packets to.

\FC-f \F[]expression
    BPF expression which selects packets to be filtered.

\FC-s \F[]snaplen
    Capture snaplen bytes of data from each packet.

\FC-p\F[]
    Disable promiscuous mode sniffing.

PROGRAM OPTIONS

\FC-u \F[]owner
    Set the output file's owning user to owner.

\FC-g \F[]group
    Set the output file's owning group to group.

\FC-m \F[]mode
    Set the output file's mode to mode, specified in octal.

\FC-t \F[]secs
    Dump file rotation interval in seconds.

\FC-c \F[]count
    Exit after capturing count packets.

\FC-T \F[]secs
    Exit after capturing during this amount of seconds.

\FC-H \F[]
    Only capture link, network, and transport headers; do not capture application-layer data.

\FC-S \F[]sample value
    Sample the packet stream by only dumping 1 in every sample value packets.

\FC-R \F[]
    Together with -S, sample the packets randomly, not systematically.

\FC-P \F[]pidfile
    Daemonize the process and write its PID to pidfile.

\FC-C \F[]config file
    File to read configuration variables from. Instead of passing configuration through the command line, a file can be used to specify values for the \FCbpf\F[], \FCdevice\F[], \FCfilefmt\F[], \FCgroup\F[], \FCinterval\F[], \FCmode\F[], \FCowner\F[], \FCpromisc\F[], and \FCsnaplen\F[] options (not all need to be specified; defaults will be used otherwise). See /usr/share/doc/pcaputils/examples/pcapdump/eth0 for an example.