Packet-o-matic

This target will save the matched packets into a pcap file. This is the same format used by tcpdump and wireshark. It has the following parameters :

• filename

File where to save the packets.
Default : dump.cap

• snaplen

Maximum size of captured packets. The default size should be enough to save all the packets in their entirety. Please note that helper_ipv4 can reassemble fragments and may be larger than the initial MTU.
Default : 1522

• layer

The first layer to use when saving packets. This can be either ethernet, linux_cooked, docsis or ipv4. Make sure the layer you want to use to save packets is present in the layers of the packets you sniff.
Default : ethernet

• unbuffered

Write the packets directly to the disk. This can significantly decrease performances. Don't change if you don't know what you are doing.
Default : no

This mode has all the parameters of the default mode except filename, plus the ones below. It will open a new file each time one of the given condition occurs.

• prefix

Prefix of the files being created including the directory.
Default : dump

• overwrite

Specify if existing files can be overwritten or not. If no, it will skip existing files and go to the next one.
Default : no

• split_size

Split the file after the specified size. 0 means unlimited.
Default : 0

• split_packets

Split the file after the specified number of packets. 0 means unlimited.
Default : 0

• split_interval

Split the file after the specified number of seconds. 0 means unlimited.
Default : 0

This mode will save each connection in a separate pcap file. It has the very same parameters than the default mode but filename. To specify where to save connections, you'll use the prefix parameter. This parameter support file path expansion.