pcapdump - dedicated packet capture utility

pcapdump  captures  packets from a network interface and writes them to a dumpfile. The filename argument
       given to -w will be formatted by strftime(3).

       pcapdump - dedicated packet capture utility

-iinterface
              Input interface to read packets from.

       -rpcapfile
              Dump file to read packets from.

       -wpcapfile
              Dump file to write filtered packets to.

       -fexpression
              BPF expression which selects packets to be filtered.

       -ssnaplen
              Capture snaplen bytes of data from each packet.

       -p     Disable promiscuous mode sniffing.

-uowner
              Set the output file's owning user to owner.

       -ggroup
              Set the output file's owning group to group.

       -mmode
              Set the output file's mode to mode, specified in octal.

       -tsecs
              Dump file rotation interval in seconds.

       -ccount
              Exit after capturing count packets.

       -Tsecs
              Exit after capturing during this amount of seconds.

       -H     Only capture link, network, and transport headers; do not capture application-layer data.

       -Ssamplevalue
              Sample the packet stream by only dumping 1 in every samplevalue packets.

       -R     Together with -S, sample the packets randomly, not systematically.

       -Ppidfile
              Daemonize the process and write its PID to pidfile.

       -Cconfigfile
              File to read configuration variables from. Instead of passing configuration  through  the  command
              line,  a  file  can be used to specify values for the bpf, device, filefmt, group, interval, mode,
              owner, promisc, and snaplen options (not all need to be specified; defaults will  be  used  other‐
              wise). See /usr/share/doc/pcaputils/examples/pcapdump/eth0 for an example.

                                                 29 October 2024                                     pcapdump(1)

pcapdump [OPTIONS]...