DUMPCAP(1) DUMPCAP(1) (NAME) dumpcap - (SYNOPSIS) dumpcap [ -a|--autostop ] ... [ -b|--ring-buffer ] ... [ -B|--buffer-size ] [ -c ] [ -C ] [ -d ] [ -D|--list-interfaces ] [ -f ] [ -F ] [ -g ] [ -i|--interface |rpcap://:/|- ] [ -I|--monitor-mode ] [ -k ,[],[],[] ] [ -L|--list-data-link-types ] [ -M ] [ -n ] [ -N ] [ -p|--no-promiscuous-mode ] [ --ifdescr ] [ --ifname ] [ -P ] [ -q ] [ -Q ] [ -s|--snapshot-length ] [ -S ] [ -t ] [ --temp-dir ] [ -w ] [ -y|--linktype ] [ --application-flavor [wireshark|stratoshark] ] [ --capture-comment ] [ --list-time-stamp-types ] [ --no-optimize ] [ --time-stamp-type ] [ --update-interval ] dumpcap -h|--help dumpcap -v|--version (DESCRIPTION) Dumpcap . . Dumpcap pcapng . -F pcap . libpcap Npcap . -w Dumpcap . -w Dumpcap . pcap . pcap ..SH " (OPTIONS)" -a|--autostop Dumpcap . test:value test : duration:value value . ( 0.5) . files:value value . filesize:value value (kB). -b dumpcap . 2 TB . packets:value value . -c . -b|--ring-buffer Dumpcap << >> (multiple files) . << >> Dumpcap . Dumpcap . -w : outfile_00001_20260714120117.pcapng outfile_00002_20260714120523.pcapng ... files << >> (ring buffer) . Dumpcap . files ( ). key:value key : duration:value value . ( 0.5) . files:value value ( ). 100000 . : . files duration interval filesize . -b -b . filesize:value value (kB). 2 TB . interval:value value . 3600 . packets:value value . printname:filename filename . filename stdout - stderr . : -b filesize:1000 -b files:5 . -B|--buffer-size ( MiB ). . (packet drop) . Dumpcap . UNIX Linux macOS \*BSD Solaris AIX libpcap 1.0.0 Windows . UNIX libpcap . . -i . -i -i . . -c . -a packets: . -C . -N . (thread) . -d () (dump) . . ( .) -D|--list-interfaces Dumpcap . . -i . Windows GUID . -f . ( ). . -i . -i -i . . -F -w . pcapng . -F . pcapng . tshark(1) . tshark editcap(1) . -g () (group-read) ( () ). -h|--help . -i|--interface |rpcap://:/|- (pipe) ..sp <> ( ) <> . Dumpcap (non-loopback) . Dumpcap . (pipe) FIFO ( ) <<->> (standard input). <<\\.\pipe\pipename>> . pcapng pcap . pcapng (endianness) . . pcapng -P . --ifdescr description -i . --ifname name -i . -I|--monitor-mode << >> (monitor mode) Wi-Fi IEEE 802.11 . . . . -i . -i -i . -k ,[],[],[> Wi-Fi IEEE 802.11 . freq . type 802.11n . type : NOHT 802.11b/g HT20 (20 MHz) HT40- HT40+ HE40 centerfreq1 HT80 centerfreq1 VHT80+80 centerfreq1 centerfreq2 VHT160 centerfreq1 EHT320 centerfreq1 -L|--list-data-link-types (data link) . -y . -M -D -L -S --list-time-stamp-types . Wireshark TShark . -n pcapng. . . -N . -C . (thread) . -p|--no-promiscuous-mode (promiscuous mode) . -p Dumpcap ( ) (multicast) . . -i . -i -i . -P pcap pcapng. pcapng . -F . -q . SIGINFO BSD <> ( control-T BSD <<>> ) . -Q . -q . SIGINFO BSD <<>> ( control-T BSD <> ) . -s|--snapshot-length (snapshot length) . snaplen . 0 262144 . . -i . -i -i . ( ) . -S . -t (thread) . --temp-dir ( ) . UNIX Linux macOS \*BSD Solaris AIX $TMPDIR /tmp . Windows %TEMP% %USERPROFILE%\AppData\Local\Temp . -v|--version . -w outfile . stdout <<->> . -y|--linktype (data link type) . -L . . -i . -i -i . ( ) . --application-flavor [wireshark|stratoshark] (application flavor) . -D . <> . --capture-comment . . . Wireshark . --list-time-stamp-types (timestamp) . . --no-optimize libpcap . . . -i . -i -i . --time-stamp-type . --update-interval . . 100ms . --log-level . : "noisy" "debug" "info" "message" "warning" "critical" "error". "warning" "warning" "critical" "error" "noisy" . . --log-fatal . "warning" "warning" "critical" "error" . --log-fatal-count (fatal) . --log-domains "GUI,Epan,sshdump". . <> ( ). --log-debug "debug" . . <> ( ). --log-noisy "noisy" . . <> ( ). --log-fatal-domains . . --log-file stderr . (CAPTURE FILTER SYNTAX) pcap-filter(7) tcpdump(8) . (SEE ALSO) wireshark(1), tshark(1), editcap(1), mergecap(1), capinfos(1), pcap(3), pcap-filter(7) tcpdump(8) (NOTES) Dumpcap 4.7.3 . Dumpcap Wireshark . Wireshark : . HTML Wireshark : . (AUTHORS) Dumpcap Wireshark Wireshark . 2026-09-03 DUMPCAP(1)