dumpcap

dumpcap [options]

dumpcap is a network traffic capture tool from the Wireshark project. It captures packets and writes them to files in pcapng or pcap format. Unlike Wireshark or tshark, dumpcap focuses solely on capture without protocol dissection.Its whole reason for existing is privilege separation. Capturing packets requires elevated privileges, while dissecting them means running an enormous body of parsing code over hostile input from the network, which is the last thing you want privileged. Wireshark and tshark therefore do not capture: they run dumpcap as a small, separate, privileged helper and read the result back unprivileged. Running dumpcap directly is simply using that helper on its own.Because it does no dissection, it is also the fastest capture path in the suite and the right choice for long-running or high-rate captures where tshark would drop packets.

-i interface

Interface to capture on. May be repeated to capture on several at once.

Write packets to this file. Use - for standard output.

List the available interfaces and exit.

List the link-layer types supported by the interface and exit.

Stop after this many packets.

Autostop condition: duration:secs, filesize:kB, files:n, or packets:n.

Ring buffer: rotate to a new file on filesize:kB, duration:secs, interval:secs, or packets:n, keeping at most files:n.

Capture filter in BPF syntax. Filtering in the kernel is far cheaper than capturing everything and discarding it later.

Do not put the interface into promiscuous mode. Promiscuous mode is the default, so this flag turns it off.

Snapshot length: bytes captured per packet. Useful for keeping headers while discarding payloads.

Write the output in pcap format instead of the default pcapng.

Quiet: do not print the running packet count.

Rotate to a new file every 100 MB, keeping the 10 most recent:

Capture needs root, or the `CAPNETRAW` and `CAPNETADMIN` capabilities on the binary. Distributions usually handle this by installing dumpcap setuid-capable and restricting it to the `wireshark` group; adding yourself to that group is the supported way to capture without root, and is why running `wireshark` as root is both unnecessary and a bad idea.Note the inverted flag: -p *disables* promiscuous mode, which is on by default. Promiscuous mode also does far less than people expect on a switched network, where you will see your own traffic and broadcasts regardless, and need a mirror port or a tap to see anyone else's.Use -f rather than filtering later. A capture filter is compiled to BPF and runs in the kernel, so unwanted packets are never copied to userspace at all, whereas a display filter in Wireshark discards them only after they have been written to disk.Capture files grow startlingly fast on a busy link. A ring buffer, a snaplen, or both are the difference between a useful capture and a full disk.

dumpcap is part of the Wireshark project, which Gerald Combs started in 1998 under the name Ethereal. It was split out of the main application after a long run of security advisories in the dissectors made the risk of a privileged monolith untenable: with the split, only the few hundred lines that actually touch the network run with elevated rights, while the millions of lines of protocol parsing do not.

wireshark(1), tshark(1), tcpdump(1), editcap(1)

Source code · Homepage · Documentation