NET.CAPTURE
net.capture is a commandline tool that provides capturing Netcap audit records from PCAP / PCAP-NG files or live from a network interface.
Description
Traffic can be captured and written to disk with various options, and encoders used to create the audit records can be included or excluded from the generated output.
Read more about this tool in the documentation: https://docs.netcap.io
Usage examples
Capture from dumpfile:
$ net.capture -r dump.pcap
Capture from interface:
$ net.capture -iface eth0
Help
$ net.capture -h
-allowmissinginit
support streams without SYN/SYN+ACK/ACK sequence
-assembly_debug_log
If true, the github.com/google/gopacket/reassembly library will log verbose debugging information (at least one line per packet)
-assembly_memuse_log
If true, the github.com/google/gopacket/reassembly library will log information regarding its memory use every once in a while.
-base string
select base layer (default "ethernet")
-bpf string
supply a BPF filter to use prior to processing packets with netcap
-buf
buffer data in memory before writing to disk (default true)
-checksum
check TCP checksum
-comp
compress output with gzip (default true)
-conn-flush-interval int
flush connections every X flows (default 10000)
-conn-timeout int
close connections older than X seconds (default 60)
-cpuprof
create cpu profile
-debug
display debug information
-dump
dump HTTP request/response as hex
-encoders
show all available encoders
-exclude string
exclude specific encoders
-files string
path to create file for HTTP 200 OK responses
-flow-flush-interval int
flush flows every X flows (default 2000)
-flow-timeout int
close flows older than X seconds (default 30)
-flushevery int
flush assembler every N packets (default 10000)
-iface string
attach to network interface and capture in live mode
-ignore-unknown
disable writing unknown packets into a pcap file
-ignorefsmerr
ignore TCP FSM errors
-include string
include specific encoders
-memprof
create memory profile
-memprofile string
write memory profile
-nodefrag
if true, do not do IPv4 defrag
-nohttp
disable HTTP parsing
-nooptcheck
do not check TCP options (useful to ignore MSS on captures with TSO)
-opts string
select decoding options (default "lazy")
-out string
specify output directory, will be created if it does not exist
-overview
print a list of all available encoders and fields
-payload
capture payload for supported layers
-pbuf int
set packet buffer size, for channels that feed data to workers (default 100)
-promisc
toggle promiscous mode for live capture (default true)
-quiet
be quiet regarding errors (default true)
-r string
read specified file, can either be a pcap or netcap audit record file
-snaplen int
configure snaplen for live capture from interface (default 1024)
-tcp-close-timeout int
close tcp streams if older than X seconds (set to 0 to keep long lived streams alive) (default 180)
-tcp-timeout int
close streams waiting for packets older than X seconds (default 120)
-verbose
be verbose
-version
print netcap package version and exit
-workers int
number of workers (default 1000)
-writeincomplete
write incomplete response