Differences

This shows you the differences between two versions of the page.

--- pom:input:pcap [2012/10/12 08:57] – external edit 127.0.0.1
+++ pom:input:pcap [2020/05/26 21:59] (current) – external edit 127.0.0.1
@@ Line 3: / Line 3: @@
 ==== Mode interface ====
 With this mode, you'll sniff packets from a specific interface. **To avoid packet loss while using input pcap, you may want to increase the nice level when running packet-o-matic.** You can also sniff from all the interfaces by specifying the interface name 'any'. When starting, it will show what output layer will be used. If you sniff from an interface, it will be either ethernet or linux_cooked for special interfaces like ppp interfaces.
 Parameters for this mode :
+^ Name ^ Default value ^ Description ^
-  * interface
+|interface|eth0|Interface name to sniff from or 'any' for all the interfaces.|
-Interface name to sniff from or 'any' for all the interfaces.
+|snaplen|1522|Maximum captured size of the packets. The default is large enough to accommodate all the packets. You may need to raise it if you need to capture jumbo frames.|
-Default : eth0.
+|promisc|no|Set the interface in promiscuous mode to capture packets not destinated to the NIC MAC address. You need to be on a hub to use this. It doesn't work when interface is set to 'any'.|
+|filter| |Have packets filtered by the kernel. Make sure you know what you are doing when using this parameter. See ''man tcpdump'' or ''man pcap-filter'' for syntax.|
-  * snaplen
-Maximum captured size of the packets. The default is large enough to accommodate all the packets. You may need to raise it if you need to capture jumbo frames.
-Default : 1522.
-  * promisc
-Set the interface in promiscuous mode to capture packets not destinated to the NIC MAC address. You need to be on a hub to use this. It doesn't work when interface is set to 'any'.
-Default : no.
-  * filter
-Have packets filtered by the kernel. Make sure you know what you are doing when using this parameter. See ''man tcpdump'' or ''man pcap-filter'' for syntax.
-Default : none.
 ==== Mode file ====
 In this mode, input_pcap will read its packets from a pcap file.
 Parameters for this mode :
+^ Name ^ Default value ^ Description ^
-  * file
+|file|dump.cap|Specify the file to read packets from.|
-Specify the file to read packets from.
+|filter| |Have packets filtered by the kernel. Make sure you know what you are doing when using this parameter. See ''man tcpdump'' or ''man pcap-filter'' for syntax.|
-Default : dump.cap
-  * filter
-Have packets filtered by the kernel. Make sure you know what you are doing when using this parameter. See ''man tcpdump'' or ''man pcap-filter'' for syntax.
-Default : none.
 ==== Mode directory ====
@@ Line 39: / Line 24: @@
 Parameters for this mode :
+^ Name ^ Default value ^ Description ^
-  * path
+|path|/tmp|Specify the directory to read packets from.|
-Specify the directory to read packets from.
+|file_extension|.cap|Specify the extension of the files that should be processed.|
-Default : /tmp
+|filter| |Have packets filtered by the kernel. Make sure you know what you are doing when using this parameter. See ''man tcpdump'' or ''man pcap-filter'' for syntax.|
-  * file_extension
-Specify the extension of the files that should be processed.
-Default : .cap
-  * filter
-Have packets filtered by the kernel. Make sure you know what you are doing when using this parameter. See ''man tcpdump'' or ''man pcap-filter'' for syntax.
-Default : none.