pcapdump(1)

💖 pcapdump — bestie edition 💖

okay so real talk, this is pcapdump, section 1 of the manual, and it's your dedicated packet capture utility. she's giving main character energy and she's here to snatch packets off your network and stash them in a file. let's get into it 🦋

---

✨ SYNOPSIS ✨

pcapdump [OPTIONS]...

that's it. that's the whole vibe. options, and lots of 'em. 👑

---

🌸 DESCRIPTION 🌸

so pcapdump captures packets from a network interface and writes them to a dumpfile. periodt. 💅

and here's the lil detail you don't wanna miss: the filename argument you hand to -w gets formatted by strftime(3). yes bestie, strftime. so you can put all your cute date/time format specifiers in there and it'll do its lil transformation thing. iykyk. ✨

---

🎀 PCAPNET OPTIONS 🎀

these are the ones that talk to the packet-capture layer. the OGs. 🌈

• -i interface — the input interface to read packets from. tell her where to look. 👀
• -r pcap file — the dump file to read packets from. (reading era, not writing era.)
• -w pcap file — the dump file to write your filtered packets to. remember the strftime(3) thing from up top? yeah. that applies here. 🌸
• -f expression — a BPF expression that selects which packets get filtered. this is the bouncer at the club. 💅
• -s snaplen — capture snaplen bytes of data from each packet. not the whole thing, just a lil slice. 🍓
• -p — disables promiscuous mode sniffing. so she minds her own business and only grabs what's addressed to her. 🙈

---

💜 PROGRAM OPTIONS 💜

the housekeeping, the scheduling, the whole backstage crew. iconic behavior only. ⭐

• -u owner — sets the output file's owning user to owner. 💖
• -g group — sets the output file's owning group to group. 🫶
• -m mode — sets the output file's mode to mode, and it's specified in octal. yes, octal. like 0644 energy. don't come at her with decimals. 🧚
• -t secs — dump file rotation interval, in seconds. she switches files on a schedule, very organized of her. 🎀
• -c count — exit after capturing count packets. she knows when to leave the party. 👑
• -T secs — exit after capturing during this amount of seconds. timed era. ⏰
• -H — only captures link, network, and transport headers; does not capture application-layer data. so the outer envelope only, no peeking at the letter inside. 💌
• -S sample value — samples the packet stream by only dumping 1 in every sample value packets. lowkey a rate limit but make it cute. 🌸
• -R — used together with -S, samples the packets randomly instead of systematically. chaos mode, but make it statistical. 🔥
• -P pidfile — daemonizes the process and writes its PID to pidfile. she's going to the background, bestie, but she left a note. 📝
• -C config file — the file to read configuration variables from. so instead of passing all your config through the command line, you can just use a file to specify values for the bpf, device, filefmt, group, interval, mode, owner, promisc, and snaplen options. and ngl, not all of them need to be specified — defaults will be used otherwise. 🦋

want an example? there's literally one waiting for you at /usr/share/doc/pcaputils/examples/pcapdump/eth0. go look, it's giving tutorial. ✨

---

and that's the whole page, bestie!! this was pcapdump(1), dated 26 December 2021, from the pcaputils crew. stay capturing, stay slaying, and pls pls pls read your BPF expressions carefully. mwah 💖🎀🦋✨