ncaptool(8)

📦 version 1.9.2, in debian bookworm, debian trixie, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

✨ ncaptool(8) ✨

okay bestie, welcome to ncaptool — the network capture tool, manual section 8 💖

🎀 NAME 🎀

ncaptool — Network capture library

🌸 SYNOPSIS 🌸

ncaptool [-h] [-d] [-m] [-f] [-r] [-w] [-v] [-S] [-e] [-i]
         [-b] [-p] [-n] [-l] [-g] [-o] [-s] [-c] [-t] [-1]
         [-2] [-k] [-Dmod] [-H]

like. that's the whole vibe in one block, no cap 🫶

🦋 DESCRIPTION 🦋

so ncaptool is a network capture library — same energy as libpcap (which it's literally based on) and tcpdump. It produces binary data in its own ncap format, and that data can either live in a dump file or get yeeted over a UDP socket. 📡

but here's the twist: unlike libpcap, it discards data link headers and only supports IPv4 and IPv6 packets. however — and this is the slay part — it can perform reassembly of IP datagrams. iconic behavior fr fr 👑

💅 OPTIONS 💅

  • -h — display this help text and exit (the "hi bestie, here's the menu" flag)
  • -d — increment debugging level
  • -m — increment message trace level
  • -f — flush outputs after every bufferable write
  • -r — destination of -s can be a remote (off-LAN) address
  • -w — use wallclock time not NCAP timestamp for -o files
  • -v — emit a traffic summary to stderr on exit
  • -S — stripe across all -s datasinks, round robin style 🔄
  • -e endline — specify continuation separator
  • -i ifname[+] — add interface as a datasource ('+' = promiscuous)
  • -b bpf — use this bpf pattern for any -i or -p datasources
  • -p file — add pcap file as a datasource ('-' = stdin)
  • -n file — add ncap file as a datasource ('-' = stdin)
  • -l socket — add datagram socket as a datasource (addr/port)
  • -g file — write msg trace to this file ('-' = stdout)
  • -o file — write ncap data to this file ('-' = stdout)
  • -s so[,r[,f]] — add this datagram socket as a datasink (addr/port) (optional ,r is the transmit rate in messages/sec) (optional ,f is schedule frequency, default is 100)
  • -c count — stop or reopen after this many msgs are processed
  • -t interval — stop or reopen after this amount of time has passed
  • -1 [+-]value — replace, set (+), or clear (-) user1 to this value
  • -2 [+-]value — replace, set (+), or clear (-) user1 to this value
  • -k cmd — make -c, -t continuous, run cmd on each new file (cmd can be empty if you just want the continuity)
  • -D mod[,args] — add module
  • -H [sd] — hide source and/or destination IP addresses 🙈

argument to -l and -s can be addr/port or addr/port..port (range)

💀 heads up bestie: -1 and -2 are listed in the original with the exact same wording — both say user1. not me fixing it, i'm keeping it verbatim, periodt. the manpage says what it says.

🌈 EXAMPLE 🌈

Common usage — the everyday, main-character pipeline:

$ ncaptool -t 3600 -k gzip -i enp9s0+ -o $FILE

and to inspect a compressed ncap file, run something like this:

$ zcat $FILE | ncaptool -n - -vmg -

lowkey satisfying when a pipe just works 😭✨

🔥 SEE ALSO 🔥

ncap(3), tcpdump(8).

👑 AUTHOR 👑

ncaptool was written by Internet Systems Consortium and Jan Andres <jandres@gmx.net>.

This manual page was written by Thiago Andrade Marques <thmarques@gmail.com> for the Debian project (but may be used by others).

okay that's the whole page, you ate that 🍓 this was ncaptool version ncaptool-1.9.2, dated 26 Mar 2020, living in manual section ncaptool(8) — and that's on periodt, go capture some packets bestie 💜🧚

📦 where this page comes from