Linux command
pcap 命令
文本
Copy it and replace filenames, paths, or keywords as needed.
命令示例
Read pcap with tcpdump
tcpdump -r [capture.pcap]
Read with tshark
tshark -r [capture.pcap]
Write pcap
tcpdump -i [eth0] -w [capture.pcap]
Filter and read
tcpdump -r [capture.pcap] 'port 80'
Convert with editcap
editcap [input.pcap] [output.pcapng]
说明
pcap (Packet Capture) is the file format used by libpcap for storing network packet data. It's the standard format for network captures, used by tcpdump, Wireshark, and many security tools.
FAQ
What is the pcap command used for?
pcap (Packet Capture) is the file format used by libpcap for storing network packet data. It's the standard format for network captures, used by tcpdump, Wireshark, and many security tools.
How do I run a basic pcap example?
Run `tcpdump -r [capture.pcap]` in a terminal, then adjust file names, paths, flags, or remote targets for your system.
Where can I find more pcap examples?
This page includes 5 examples for pcap, plus related commands for nearby Linux tasks.