DUMPCAP(1)

📦
version 4.7.4 · 17 versions
, in arch rolling

👑 DUMPCAP(1) 🎀 — the dumpcap manual, bestie edition

okay so real talk: dumpcap is that girl. she's a network traffic dump tool and she's about to make packet capture make sense, fr fr. let's go 💅

✨ NAME ✨

dumpcap — dump network traffic 💖

🦋 SYNOPSIS 🦋

dumpcap [ -a|--autostop <capture autostop condition> ] ...
[ -b|--ring-buffer <capture ring buffer option> ] ...
[ -B|--buffer-size <capture buffer size> ] [ -c <capture packet count> ]
[ -C <byte limit> ] [ -d ] [ -D|--list-interfaces ]
[ -f <capture filter> ] [ -F <file format> ] [ -g ]
[ -i|--interface <capture interface>|rpcap://<host>:<port>/<capture interface>|- ]
[ -I|--monitor-mode ]
[ -k <freq>,[<type>],[<center_freq1>],[<center_freq2>] ]
[ -L|--list-data-link-types ] [ -M ] [ -n ] [ -N <packet limit> ]
[ -p|--no-promiscuous-mode ] [ --ifdescr <description> ]
[ --ifname <name> ] [ -P ] [ -q ] [ -Q ]
[ -s|--snapshot-length <capture snaplen> ] [ -S ] [ -t ]
[ --temp-dir <directory> ] [ -w <outfile> ]
[ -y|--linktype <capture link type> ]
[ --application-flavor [wireshark|stratoshark] ]
[ --capture-comment <comment> ] [ --list-time-stamp-types ]
[ --no-optimize ] [ --process-info[=basic|full] ]
[ --time-stamp-type <type> ] [ --update-interval <interval> ]

dumpcap -h|--help

dumpcap -v|--version

🌸 DESCRIPTION 🌸

So dumpcap is a network traffic dump tool, periodt. She lets you capture packet data from a live network and write those packets straight into a file. Her default capture file format is pcapng format — but if you want the classic pcap vibe, you can pass the -F option and she'll write the output file in the pcap format instead. 💫

Now, if you run her with literally no options set, she'll use the libpcap or Npcap library to capture traffic from the first available network interface, and she writes the received raw packet data — plus the packets' time stamps — into a capture file. iconic behaviour honestly.

If you don't specify the -w option, dumpcap writes to a newly created capture file with a randomly chosen name. If you do specify -w, she writes to the file you named in that option. simple as that 💅

Packet capturing is performed with the pcap library, and the capture filter syntax follows the rules of the pcap library. iykyk.

✨ OPTIONS ✨

  • -a, --autostop <capture autostop condition> — tell dumpcap when to stop writing to a capture file. the criterion is of the form test:value, where test is one of the following:
    • duration:value — stop writing to a capture file after value seconds have elapsed. floating point values (e.g. 0.5) are allowed. ⏳
    • files:value — stop writing to capture files after value number of files were written.
    • filesize:value — stop writing to a capture file after it reaches a size of value kB. if this option is used together with the -b option, dumpcap will stop writing to the current capture file and switch to the next one if filesize is reached. note that the filesize is limited to a maximum value of 2 TB. 🫠
    • packets:value — stop writing to a capture file after value packets have been written. acts the same as -c <capture packet count>.
  • -b, --ring-buffer <capture ring buffer option> — this makes dumpcap run in "multiple files" mode. in "multiple files" mode, she writes to several capture files. when the first capture file fills up, dumpcap switches writing to the next file and so on. 🔁

the created filenames are based on the filename you gave with the -w option, the number of the file, and the creation date and time, like:

outfile_00001_20260714120117.pcapng
outfile_00002_20260714120523.pcapng
...

with the files option it's also possible to form a "ring buffer". this fills up new files until the number of files you specified, at which point dumpcap discards the data in the first file and starts writing to that file again, and so on. if the files option is not set, new files fill up until one of the capture stop conditions match (or until the disk is full 💀).

the criterion is of the form key:value, where key is one of:

  • duration:value — switch to the next file after value seconds have elapsed, even if the current file isn't completely filled up. floating point values (e.g. 0.5) are allowed.
  • files:value — begin again with the first file after value number of files were written (form a ring buffer). this value must be less than 100000. caution should be used when using large numbers of files: some filesystems do not handle many files in a single directory well. the files criterion requires either duration, interval or filesize to be specified to control when to go to the next file. also, heads up: each -b parameter takes exactly one criterion — to specify two criteria, each must be preceded by the -b option. 🙈
  • filesize:value — switch to the next file after it reaches a size of value kB. note that the filesize is limited to a maximum value of 2 TB.
  • interval:value — switch to the next file when the time is an exact multiple of value seconds. for example, use 3600 to switch to a new file every hour on the hour. ⏰
  • packets:value — switch to the next file after it contains value packets.
  • printname:filename — print the name of the most recently written file to filename after the file is closed. filename can be stdout or - for standard output, or stderr for standard error.
Example: -b filesize:1000 -b files:5 results in a ring buffer of five files of size one megabyte each. 🎀
  • -B, --buffer-size <capture buffer size> — set the capture buffer size in MiB. the default is 2 MiB. the capture driver uses this to buffer packet data until that data can be written to disk. if you're seeing packet drops while capturing, try bumping this size up. but ngl, note this: while dumpcap attempts to set the buffer size to 2 MiB by default (and can be told to set it to a larger value), the system or interface you're capturing on might silently limit the capture buffer size to a lower value, or raise it to a higher value. sneaky.

this is available on UNIX-compatible systems — such as Linux, macOS, \*BSD, Solaris, and AIX — with libpcap 1.0.0 or later, and on Windows. it is not available on UNIX-compatible systems with earlier versions of libpcap. 😭

this option can occur multiple times. if used before the first occurrence of the -i option, it sets the default capture buffer size. if used after an -i option, it sets the capture buffer size for the interface specified by the last -i option occurring before this option. if the capture buffer size is not set specifically, the default capture buffer size is used instead.

  • -c <capture packet count> — set the maximum number of packets to read when capturing live data. acts the same as -a packets:<capture packet count>.
  • -C <byte limit> — limit the amount of memory in bytes used for storing captured packets in memory while processing it. if used in combination with the -N option, both limits will apply. setting this limit will enable the usage of the separate thread per interface. 🧵
  • -d — dump the code generated for the capture filter(s) in a human-readable form, and exit. if capturing on multiple interfaces, the capture filter for each interface will be printed in the order that the interfaces were specified. (note that a capture filter may compile differently on different interfaces.) 👀
  • -D, --list-interfaces — print a list of the interfaces on which dumpcap can capture, and exit. for each network interface, a number and an interface name is printed — possibly followed by a text description of the interface. the interface name or the number can be supplied to the -i flag to specify an interface on which to capture. the number can be useful on Windows systems, where the interfaces have long names that usually contain a GUID. 🪟
  • -f <capture filter> — set the capture filter expression. 🎯

the entire filter expression must be specified as a single argument (which means that if it contains spaces, it must be quoted).

this option can occur multiple times. if used before the first occurrence of the -i option, it sets the default capture filter expression. if used after an -i option, it sets the capture filter expression for the interface specified by the last -i option occurring before this option. if the capture filter expression is not set specifically, the default capture filter expression is used if provided.

  • -F <file format> — set the file format of the output capture file written using the -w option. in situations that require the pcapng format — such as capturing from multiple interfaces — this option will be overridden. the option -F without a value will list the available formats. the default is the pcapng format. 🌈
fewer formats are supported than by tshark(1); this is intentional for security reasons. use tshark or capture and then convert the file with editcap(1) if another format is needed. 🔒
  • -g — this option causes the output file(s) to be created with group-read permission (meaning that the output file(s) can be read by other members of the calling user's group). 🫶
  • -h, --help — print the version number and options and exit.
  • -i, --interface <capture interface>|rpcap://<host>:<port>/<capture interface>|- — set the name of the network interface or pipe to use for live packet capture. 🦋

network interface names should match one of the names listed in "tshark -D" (described above); a number, as reported by "dumpcap -D", can also be used.

if no interface is specified, dumpcap searches the list of interfaces, choosing the first non-loopback interface if there are any non-loopback interfaces, and choosing the first loopback interface if there are no non-loopback interfaces. if there are no interfaces at all, dumpcap reports an error and doesn't start the capture. 😤

pipe names should either be the name of a FIFO (named pipe) or - to read data from the standard input. on Windows systems, pipe names must be of the form "\\.\pipe\pipename". data read from pipes must be in standard pcapng or pcap format, and pcapng data must have the same endianness as the capturing host. 🪄

this option can occur multiple times. when capturing from multiple interfaces, the capture file will be saved in pcapng format, even if -P is specified.

  • --ifdescr <description> — use description as the description in the capture file for the interface or pipe specified before it with -i. ✍️
  • --ifname <name> — use name as the name in the capture file for the interface or pipe specified before it with -i.
  • -I, --monitor-mode

...okay so let's keep going with the options, because we're literally not even close to done 💅

Put the interface in "monitor mode"; this is supported only on IEEE 802.11 Wi-Fi interfaces, and supported only on some operating systems.

Bestie, listen to me: in monitor mode the adapter might disassociate from the network it's currently associated with, so you won't be able to use any wireless networks with that adapter. That could block you from grabbing files off a network server, or resolving host names or network addresses — yep, even if you're capturing in monitor mode and aren't connected to some other network with another adapter. 🙈

This option can occur multiple times, lowkey. If you use it before the first occurrence of the -i option, it enables monitor mode for all interfaces. If you use it after an -i option, it enables monitor mode for the interface specified by the last -i option that occurred before this one. Slay, that's the whole pattern, you'll see it everywhere.

  • -k <freq>,[<type>],[<center_freq1>],[<center_freq2>] — set the channel on the interface ✨ this is supported only on IEEE 802.11 Wi-Fi interfaces, and supported only on some operating systems, ngl.

So freq is the frequency of the channel. type is the type of the channel for 802.11n and later. The values for type are:

  • NOHT — used for 802.11b/g channels
  • HT20 — 20 MHz channel
  • HT40- — 40 MHz primary channel and a lower secondary channel
  • HT40+ — 40 MHz primary channel and a higher secondary channel
  • HE40 — 40 MHz channel, with centerfreq1 as its center frequency
  • HT80 — 80 MHz channel, with centerfreq1 as its center frequency
  • VHT80+80 — two 80 MHz channels combined, with centerfreq1 and centerfreq2 as the center frequencies of the two channels
  • VHT160 — 160 MHz channel, with centerfreq1 as its center frequency
  • EHT320 — 320 MHz channel, with centerfreq1 as its center frequency
  • -L, --list-data-link-types — list the data link types supported by the interface and then exit. The reported link types are the exact values you can feed to the -y option. Iconic. 👑
  • -M — when it's used with -D, -L, -S or --list-time-stamp-types, print machine-readable output. This machine-readable output is meant to be read by Wireshark and TShark, and heads up: its format is subject to change from release to release. So don't go building your whole personality on it, k? 💀
  • -n — save files as pcapng. This is the default. This option is deprecated and may be removed.
  • -N <packet limit> — limit the number of packets used for storing captured packets in memory while processing it. If you use it together with the -C option, both limits apply. Setting this limit will enable the usage of the separate thread per interface. multitasking queen behavior fr fr 🧚
  • -p, --no-promiscuous-mode — don't put the interface into promiscuous mode. But real talk: the interface might be in promiscuous mode for some other reason, so -p cannot be used to guarantee that the only traffic captured is traffic sent to or from the machine Dumpcap is running on, broadcast traffic, and multicast traffic to addresses received by that machine. Like, it's not a filter, bestie, don't be fooled. 🫶

This option can occur multiple times. If you use it before the first occurrence of the -i option, no interface will be put into promiscuous mode. If you use it after an -i option, the interface specified by the last -i option occurring before this option won't be put into promiscuous mode.

  • -P — save files as pcap instead of the default pcapng. In situations that require pcapng, such as capturing from multiple interfaces, this option will be overridden. Also it's deprecated in favor of the -F option and may be removed. old news, we're moving on 💅
  • -q — when capturing packets, don't show the continuous count of packets captured that normally appears when saving a capture to a file; instead, just show a count of packets captured at the end of the capture. On systems that support the SIGINFO signal — like various BSDs — you can make the current count show up by typing your "status" character (typically Ctrl+T, although on at least some BSDs it might be set to "disabled" by default, so you'd have to explicitly set it to actually use it). iykyk 🌸
  • -Q — when capturing packets, don't display any of this on the standard error: the initial message saying what interfaces the capture is happening on, the messages saying what file a capture is being written to, the continuous count of packets captured that's normally shown when saving to a file, and the message at the end of the capture with the packet count. This outputs less than the -q option does — only true errors get shown on the standard error. The quietest of the quiet. 🤫

Same deal as -q on systems that support the SIGINFO signal, such as various BSDs: you can make the current count appear by typing your "status" character (typically Ctrl+T, although it might be set to "disabled" by default on at least some BSDs, so you'd have to explicitly set it to use it).

  • -s <capture snaplen>, --snapshot-length <capture snaplen> — set the default snapshot length to use when capturing live data. No more than snaplen bytes of each network packet will be read into memory, or saved to disk. A value of 0 specifies a snapshot length of 262144, so that the full packet is captured — and that's the default, bestie. ⭐

This option can occur multiple times. If you use it before the first occurrence of the -i option, it sets the default snapshot length. If you use it after an -i option, it sets the snapshot length for the interface specified by the last -i option occurring before this option. If the snapshot length isn't set specifically, the default snapshot length is used if provided.

  • -S — print statistics for each interface once every second. numbers going brrr 📊
  • -t — use a separate thread per interface.
  • --temp-dir <directory> — specifies the directory where temporary files (capture files included) are to be written. Default behavior on UNIX-compatible systems — such as Linux, macOS, *BSD, Solaris, and AIX — is to use the environment variable $TMPDIR if it's set, and the system default, typically /tmp, if it's not. On Windows, the %TEMP% environment variable is used, which typically defaults to %USERPROFILE%\AppData\Local\Temp. 🎀
  • -v, --version — print the full version information and exit.
  • -w <outfile> — write raw packet data to outfile. Use "-" for stdout. 🦋
  • -y <capture link type>, --linktype <capture link type> — set the data link type to use while capturing packets. The values reported by -L are the values you can use here. match made in heaven ✨

This option can occur multiple times. If you use it before the first occurrence of the -i option, it sets the default capture link type. If you use it after an -i option, it sets the capture link type for the interface specified by the last -i option occurring before this option. If the capture link type isn't set specifically, the default capture link type is used if provided.

  • --application-flavor [wireshark|stratoshark] — set the application flavor. It makes the -D option output and other behavior suitable for packet capture or for system call and log capture. The default flavor is "wireshark". 🐬
  • --capture-comment <comment> — add a capture comment to the output file, if the output file format supports it.

Heads up: this option is only available if we output the captured packets to a single file.

This option may be specified multiple times. Note that Wireshark currently only displays the first comment of a capture file. rude but ok 😭

  • --list-time-stamp-types — list the time stamp types supported for the interface. If no time stamp type can be set, no time stamp types are listed. empty list is still a list, periodt 💜
  • --no-optimize — do not run the libpcap optimizer when generating code for a capture filter. Super useful if you suspect a bug in the optimizer, or for instructive purposes.

This option can occur multiple times. If you use it before the first occurrence of the -i option, capture filters are not optimized for all interfaces. If you use it after an -i option, the capture filter for the interface specified by the last -i option occurring before this option is not optimized.

  • --process-info[=basic|full] — record, for each packet, the processes on this host that sent or received it, when the packet belongs to a TCP or UDP socket. The process ID goes in an epb_processid_threadid option of the packet's block, and a Process Information Block describing the process is written once per output file. Wireshark shows them as the frame.process fields. 🔥

With basic, which is the default, a process is described by what identifies it: its ID, name and start time, which is what tools such as netstat show. With full, its executable path, command line, parent process ID and user are recorded as well.

Okay so this part matters, bestie: those full fields can be sensitive. A command line can contain a password or a token, and a path can contain the name of a user. They're stored in the capture file as they are, for everybody the file is given to — so use full only for files that will be handled accordingly. With basic they are not even read. 🙈

The argument has to be attached with an equals sign, as in --process-info=full. No space, got it?

The processes are found in the operating system's socket tables, so a socket must still exist when its packet is captured — very short-lived sockets can be missed. Which processes can be identified depends on privileges: on Windows, all of them; on Linux, the user's own, or all of them if dumpcap runs as root or has the CAP_SYS_PTRACE capability, which it then keeps, and nothing else, after opening the interfaces; on macOS, the user's own, or all of them if dumpcap runs as root. Not supported on other platforms. Requires the pcapng file format.

  • --time-stamp-type <type> — change the interface's timestamp method. ⏰
  • --update-interval <interval> — set the length of time in milliseconds between new packet reports during a capture. It also sets the granularity of file duration conditions. The default value is 100ms. 🌈

🔍 DIAGNOSTIC OPTIONS 🔍

okay bestie, these are the log knobs — very “let me see what’s happening under the hood” energy 👑

  • --log-level <level> — sets the active log level. Supported levels, lowest to highest, are "noisy", "debug", "info", "message", "warning", "critical", and "error". Messages at each level and higher get printed — so "warning" prints "warning", "critical", and "error" messages, and "noisy" prints all messages. Levels are case insensitive.
  • --log-fatal <level> — aborts the program if any messages are logged at the specified level or higher. For example, "warning" aborts on any "warning", "critical", or "error" messages.
  • --log-fatal-count <count> — the amount of fatal log messages which may pass before the program is aborted.
  • --log-domains <list> — only prints messages for the specified log domains, e.g. "GUI,Epan,sshdump". The list of domains must be comma-separated. Can be negated with "!" as the first character (inverts the match).
  • --log-debug <list> — forces the specified domains to log at the "debug" level. List of domains must be comma-separated. Can be negated with "!" as the first character (inverts the match).
  • --log-noisy <list> — forces the specified domains to log at the "noisy" level. List of domains must be comma-separated. Can be negated with "!" as the first character (inverts the match).
  • --log-fatal-domains <list> — aborts the program if any messages are logged for the specified log domains. List of domains must be comma-separated.
  • --log-file <path> — writes log messages and stderr output to the specified file.

🦋 CAPTURE FILTER SYNTAX 🦋

For capture filter syntax, go read the manual page of pcap-filter(7) — or, if that doesn’t exist, tcpdump(8) — or, if that doesn’t exist, the wiki at https://gitlab.com/wireshark/wireshark/-/wikis/CaptureFilters.

🌈 SEE ALSO 🌈

Go hang out with wireshark(1), tshark(1), editcap(1), mergecap(1), capinfos(1), pcap(3), and pcap-filter(7) or tcpdump(8).

📝 NOTES 📝

Bestie, this is the manual page for Dumpcap 4.7.4. Dumpcap is part of the Wireshark distribution. The latest version of Wireshark can be found at https://www.wireshark.org.

HTML versions of the Wireshark project man pages are available at https://www.wireshark.org/docs/man-pages.

🫶 AUTHORS 🫶

Dumpcap is derived from the Wireshark capturing engine code; see the list of authors in the Wireshark man page for a list of authors of that code. periodt 💅

💖 that’s the whole DUMPCAP(1) page, bestie — Dumpcap 4.7.4, dated 2026-10-08. slay 🎀

📦 where this page comes from