You can specify packet filter commands after the command line switches just like in tcpdump or Snort. If
no filter is defined it will capture all packets coming to the interface.
A summary of available options is included below.
-h Show summary of options.
-v Show version of program.
-ccount Log count packets and exit.
-d Daemonize at startup.
-fbdffile
Load the BPF filter to use from bdffile.
-F Flush the pcap buffer for each packet. As each packet is saved, it will be written to the
output file rather than being written only when the output buffer fills.
-ggroupname
Set the group ID of the process running the program to groupname.
-iinterface
Grab packets from the interface interface.
-lpath Log all the pcap log files to directory path.
-mcount Generate count log files and exit. If using Ringbufer mode then write files and delete the
oldest file in the set when you exceed log files written. The program will not exit when in
this mode.
-Mpct Used in concert with the -r ringbuffer switch this option will write log files to the disk
until it is at pct utilization and then roll over and delete the oldest log file. For example,
"-M 90" would write files to the disk until it is 90% utilized and then roll over and delete
the oldest file in the logging directory. If the -s "size" switch is not set then the default
log file size is 2GB.
-nname Set output filename prefix to name. The default is daemonlogger.pcap.
-ooutinterface
Act as a software tap: disable logging and retransmit all data from interface to outinterface.
-ppidfile
When running in daemon mode, use pidfile for the name of the PID file created. The default is
daemonlogger.pid.
-Ppidpath
When running in daemon mode, use pidpath as the directory where PID files will be created. The
default is /var/run.
-r Activate ringbuffer mode.
-Rpcapfile
Read packets from pcapfile instead of using an input interface.
-sbytes Rollover the log file every bytes bytes. By default the rollover occurs every 2 GB. The
parameter bytes can be appended with "k" (for KiloBytes), "m" (for MegaBytes), "g" (for
Gigabytes) and "t" (for TeraBytes).
-Ssnaplen
Capture snaplen bytes per packet. If not defined, all the contents of the packets will be
captured (which is equivalent to setting snaplen to 65535 bytes.
-ttime Rollover the log file on specific time intervals. The time interval can be appended with "m"
(for minutes), "h" (for hours) or "d" (for days). If no interval selector is used then the
default rollover interval is in seconds. For example, "-t 60" rolls the log file over every 60
seconds and "-t 2h" rolls the log file over every two hours at the top of the hour. In the case
of minute/hour/day-based rollovers, the will round to the next highest hour. For example, if
the program is told to rollover every 2 hours and is started 38 minutes into the current hour
it will add 2 to the current hour and rollover as scheduled at the top of the hour at + 2. If
the program was started at 13:38 it would roll over the logfile at 15:00.
-uusername
When daemonized, the process' user ID will be set to username.
-Tchrootpath
Chroot directory to chrootpath.
-z Select log file pruning behavior. Omitting this switch results in the default mode being used
where the oldest log file in the logging directory is pruned. Setting the -z switch changes
the behavior so that daemonlogger will prune the oldest file from its current instantiation and
leave files from older runs in the same logging directory alone.
Install Now
PNG Icons
