We can start a very basic packet capture by invoking dumpcap with the command below. Further, like tcpdump, it is built on the libpcap library and uses the same capture filter syntax. In fact, the Wireshark capture options dialog pictured below is primarily a wrapper for arguments passed to dumpcap.ĭumpcap can be run independently from Wireshark to capture packets to a file or series of files on disk, and makes for an efficient long-term capture solution. I explained in the article Sniffing with Wireshark as a Non-Root User that Wireshark relies on the dumpcap executable for its core packet capturing functionality, with more complex features offloaded to the Wireshark GUI and tshark. Alternatively, the Wireshark package includes a very small command line utility (less than one tenth the size of tcpdump) called dumpcap. While Wireshark is an excellent packet analysis application, its graphical interface is quite demanding on system resources (memory in particular) and is intended for use only in low-throughput environments or offline packet analysis (where packets are read from a file on disk).įor persistent traffic collection, such as that performed by an IDS/IPS, many people opt to use the popular packet capture utility tcpdump. A reader recently asked for my opinion on building a server to be dedicated to network traffic capturing with Wireshark.

Wireshark cheat sheet packet life