nsntrace - Perform a network trace of a process by using Linux network namespaces

JonasDanielsson <jonas@threetimestwo.org>
           Original author

nsntrace                                           04/01/2024                                        NSNTRACE(1)

nsntrace uses Linux network namespaces to perform network traces of the specified program. The traces are
       stored as pcap files. And can later be analyzed by applications such as wireshark.

       nsntrace creates a new network namespace and launches the specified program in it. This will ensure that
       all the packets we trace come from the system or the specified program.

       To get around the isolation caused by the network namespace a virtual network interface is created. And
       in order for the program network traffic to reach the root network namespace iptables is used.

       Since nsntrace uses iptables and traces raw sockets it needs to be run as root.

       On success, 0 is returned; otherwise, a non-zero failure code is returned.

       nsntrace - Perform a network trace of a process by using Linux network namespaces

       The following options are understood:

       --devicedev, -ddev
           The network device to use in trace.

       --use-public-dns
           Override resolv.conf in namespace to use public nameservers from Quad9 (9.9.9.9), Cloudflare
           (1.1.1.1), Google (8.8.8.8) and OpenDNS (208.67.222.222).

       --outfilefile, -ofile
           Write the trace output to the file file. Default is nsntrace.pcap. Use '-' for stdout.

       --useruser, -uuser
           Run program with the user ID, group ID and supplementary groups of user.

       --filterfilter, -ffilter
           The capture filter to use while capturing. See pcap-filter(7) for filter syntax.

nsntrace [options] program [arguments]