User Tools

Site Tools


pom:target:pcap

target_pcap

This target will save the matched packets into a pcap file. This is the same format used by tcpdump and wireshark.

Mode default

Parameters :

Name Default value Description
filenamedump.capFile where to save the packets.
snaplen1522Maximum size of captured packets. The default size should be enough to save all the packets in their entirety. Please note that helper_ipv4 can reassemble fragments and may be larger than the initial MTU.
layerethernetThe first layer to use when saving packets. This can be either ethernet, linux_cooked, docsis or ipv4. Make sure the layer you want to use to save packets is present in the layers of the packets you sniff.
unbufferednoWrite the packets directly to the disk. This can significantly decrease performances. Don't change if you don't know what you are doing.

Mode split

This mode has all the parameters of the default mode except filename, plus the ones below. It will open a new file each time one of the given condition occurs.

Additional parameters:

Name Default value Description
prefixdumpPrefix of the files being created including the directory.
overwritenoSpecify if existing files can be overwritten or not. If no, it will skip existing files and go to the next one.
split_size0Split the file after the specified size. 0 means unlimited.
split_packets0Split the file after the specified number of packets. 0 means unlimited.
split_interval0Split the file after the specified number of seconds. 0 means unlimited.

Mode connection

This mode will save each connection in a separate pcap file. It has the very same parameters than the default mode but filename. To specify where to save connections, you'll use the prefix parameter. This parameter support file path expansion.

pom/target/pcap.txt · Last modified: 2012/10/12 09:29 by 2001:7e8:2221:600:9471:feff:febb:91f7