NGPCAP(8) System Manager's Manual NGPCAP(8) NAME ngpcap -- netgraph packet capture utility SYNOPSIS ngpcap [-n] [-j jail] [-s snaplen] spec [spec ...] DESCRIPTION The ngpcap utility creates an ng_pcap(4), connects it to all the specs (up to NG_PCAP_MAX_LINKS) provided and streams pcap(3) data to stdtout. This is a simpler way of doing what can already be done with ngctl(8) and ng- hook(8). It also alows capturing larger packet snapshots than nghook(8) is able to since it is hardcoded. The following options are available: -n Disable automatic loading of ng_socket(4) and ng_pcap(4) kernel modules. -j jail Perform the actions inside the jail. Specifications are colon separated strings with the following components, none of which are optional: <type:node:hook> type the type of traffic this link will send. This must be set to one of the options for NGM_PCAP_SET_SOURCE_TYPE (setsourcetype) (see ng_pcap(4) for details). node:hook a netgraph node and one of its hooks to connect as a source for packet capture. EXIT STATUS The ngpcap utility exits 0 on success, and >0 if an error occurs. EXAMPLES Using the same example set up in ng_pcap(4): right2left ---+ +--------------------+ | | left2right | source0 +----------+ +--+--+--+ +----+----+ | ng_iface | | ng_tee | | ng_pcap | | foo0 | | tee0 | | pcap0 | +----+-----+ +--+--+--+ +---------+ | source0 left | | +---------------------+ +--- right As in the ng_pcap(4), the interface is not connected to anything but we can still use it to capture packets. But now we don't actually have to set up the ng_pcap(4) node, that is done for us by this utility. #!/bin/sh ngctl -f- << EOF mkpeer .: iface i inet name .:i foo0 disconnect .: i mkpeer foo0: tee inet left name foo0:inet tee0 EOF Before using you need to configure the interface. #!/bin/sh ifn=$(ngctl msg foo0: getifname | tail -1 | cut -d\" -f2) ifconfig $ifn name foo0 ifconfig foo0 inet 192.168.128.1 192.168.128.2 up Now we can use our utility to start the capture: #!/bin/sh ngpcap -s 1500 inet:tee0:left2right | /usr/sbin/tcpdump -r - You will of course need to issue a ping to see traffic: #!/bin/sh ping 192.168.128.2 SEE ALSO tcpdump(1), pcap(3), ng_iface(4), ng_socket(4), ngctl(8), nghook(8) AUTHORS David Marker <dave@freedave.net> FreeBSD ports 15.quarterly September 13, 2025 NGPCAP(8)
NAME | SYNOPSIS | DESCRIPTION | EXIT STATUS | EXAMPLES | SEE ALSO | AUTHORS
Want to link to this manual page? Use this URL:
<https://man.freebsd.org/cgi/man.cgi?query=ngpcap&sektion=8&manpath=FreeBSD+Ports+15.1.quarterly>