ANT Multi-Point Capture


A utility for capturing packets concurrently on several network devices and saving output in a single file while making an effort to minimize packet reordering in the output. This tool allows breaking output into multiple files based on size and time and compressing it on the fly by piping to a separate compression process.


This utility captures network traffic from several different sources, merges the output and writes out a single output stream. The stream may be optionally broken up into different timestamp-named files based on time duration or size. Further, before saving, the output may be compressed on the fly by piping it out through an external binary compressor. All compression would be done in a separate process, thus increasing total throughput.


This package requires Libtrace version 4 or later. You can find more information about libtrace here.


mtracecap flags outputuri traceuri [traceuri...]
mtracecap flags -B baseuri traceuri [traceuri...]

where flags are:
[-B | --baseuri] baseuri
    Output timestamped files to this baseuri
[-F | --filter] bpf
    Discard packets not matching the filter
[-G | --rotate-seconds] seconds
    Rotate output every so often, even if there are no packets
[-S | --rotate-sizemb] sizeMB
    Rotate output when it exceeds sizeMB
[-H | --libtrace-help]
    Print libtrace runtime documentation
[-h | --help]
    Print this help
[-s | --snaplen] bytes
    Capture this much of a packet
[-U | --use-utc]
    Use UTC in timestamping files
[-v | --verbose]
    Verbose output on stderr
[-W | --watchfile] filename
    Wait until the watchfile is created before proceeding with next segment
[-w | --maxwait_ms] wait_ms
[-z | --compress-level] level
    Sets compression level of output
[-Z | --compress-type] type
    Sets compression type
    Sets output file extension (used with -B)
    Run capture as <username>
    Pipe output through <command> first