IPFWPCAP(8)

📦 version 15.1, in freebsd 14.5, freebsd 15.1

💖 IPFWPCAP(8) — the ipfwpcap girlies' guide 💖

okay so this is ipfwpcap, straight out of the System Manager's Manual and honestly? she's iconic. buckle up bestie ✨

🌸 NAME 🌸

ipfwpcap — copy diverted packets to a file in tcpdump format. that's it, that's the whole vibe 🎀

🦋 SYNOPSIS 🦋

ipfwpcap [-dr] [-b maxbytes] [-p maxpkts] [-P pidfile] portnum dumpfile

💅 DESCRIPTION 💅

so here's the tea ☕ — the ipfwpcap utility is used to copy diverted packets to a file in tcpdump(1) format. the interesting packets get diverted by ipfw(8) to a port that ipfwpcap is listening on (main character energy, honestly). and then — plot twist 😭 — the packets are dropped unless -r is used. like, gone. poof. no cap.

The options are as follows, and yes I'm listing every single one because we don't skip 💜

  • -d — turns on extra debugging messages. she's chatty, she's verbose, she's telling you everything 🔍
  • -r — writes packets back to the divert(4) socket. the packets get to live another day 🫶
  • -rr — indicates that it is okay to quit if maxbytes or maxpkts are reached. heads up though: diverted packets will silently disappear if nothing is listening on the divert(4) socket 💀
  • -b maxbytes — stop dumping after maxbytes bytes. that's the limit, bestie 🛑
  • -p maxpkts — stop dumping after maxpkt packets. counting every single one ✨
  • -P pidfile — file to store PID number in. default is /var/run/ipwfpcap.portnr.pid 📌

The portnum argument specifies which divert(4) socket port to listen on. The dumpfile argument is the path to the file to write captured packets to. and get this — specify - to write to stdout 🌈

⭐ EXIT STATUS ⭐

The ipfwpcap utility exits 0 on success, and >0 if an error occurs. simple queen behaviour 👑

🍓 EXAMPLES 🍓

ipfwpcap -r 8091 divt.log &

Starts ipfwpcap as a background job listening to port 8091 and reflecting the packets back to the socket. lowkey obsessed with her 🧚

ipfw add 2864 divert 8091 ip from 192.0.2.101

Example ipfw(8) rule to divert all packets from 192.0.2.101 to port 8091. See ipfw(8) for details — iykyk 💖

🔥 SEE ALSO 🔥

tcpdump(1), pcap(3), divert(4), ipfw(8) — go read the whole friend group, fr fr 📚

🌈 HISTORY 🌈

The ipfwpcap utility first appeared in FreeBSD 7.0. a true pioneer 💫

👑 AUTHORS 👑

ipfwpcap was written by P. Kern <pkern@cns.utoronto.ca>. This manual page was written by Niclas Zeising <zeising@FreeBSD.org>. legends, both of them 🙌

and that's the whole page, bestie, every last crumb of it — not me leaving out a single flag, no cap 💀💅

mwah 💋 this page is from the Debian edition of the manual, dated May 22, 2006 — a vintage icon serving looks since the mid-aughts 🎀✨

📦 where this page comes from