Wireshark - 1.0 Betriebsanweisung PDF herunterladen (Seite 265)

D.4. dumpcap: Capturing with dumpcap for

viewing with Wireshark

Dumpcap is a network traffic dump tool. It captures packet data from a live network and writes the

packets to a file. Dumpcap's native capture file format is libpcap format, which is also the format

used by Wireshark, tcpdump and various other tools.

Without any options set it will use the pcap library to capture traffic from the first available network

interface and write the received raw packet data, along with the packets' time stamps into a libpcap

file.

Packet capturing is performed with the pcap library. The capture filter syntax follows the rules of

the pcap library.

Example D.1. Help information available from dumpcap

Dumpcap 0.99.6

Capture network packets and dump them into a libpcap file.

See http://www.wireshark.org for more information.

Usage: dumpcap [options] ...

Capture interface:

-i <interface> name or idx of interface (def: first none loopback)

-f <capture filter> packet filter in libpcap filter syntax

-s <snaplen> packet snapshot length (def: 65535)

-p don't capture in promiscuous mode

-B <buffer size> size of kernel buffer (def: 1MB)

-y <link type> link layer type (def: first appropriate)

-D print list of interfaces and exit

-L print list of link-layer types of iface and exit

Stop conditions:

-c <packet count> stop after n packets (def: infinite)

-a <autostop cond.> ... duration:NUM - stop after NUM seconds

filesize:NUM - stop this file after NUM KB

files:NUM - stop after NUM files

Output (files):

-w <filename> name of file to save (def: tempfile)

-b <ringbuffer opt.> ... duration:NUM - switch to next file after NUM secs

filesize:NUM - switch to next file after NUM KB

files:NUM - ringbuffer: replace after NUM files

Miscellaneous:

-v print version information and exit

-h display this help and exit

Example: dumpcap -i eth0 -a duration:60 -w output.pcap

"Capture network packets from interface eth0 until 60s passed into output.pcap"

Use Ctrl-C to stop capturing at any time.

Related command line tools

250

1 2 ... 260 261 262 263 264 265 266 267 268 269 270 ... 283 284

Keine Kommentare

Wireshark - 1.0 Betriebsanweisung Seite 265