21 | | $ mkdir /tmp/nfcap-test |
22 | | $ nfcapd -E -p 9001 -l /tmp/nfcap-test |
23 | | |
24 | | ... after a while, a series of flows should be dumped on your screen. |
25 | | |
26 | | Stop the tool with CTRL+C, then look at the contents of /tmp/nfcap-test |
27 | | |
28 | | $ ls -l /tmp/nfcap-test |
29 | | |
30 | | You should see one or more files called nfcapd.<YEAR><MON><DAY><HR><MIN> |
31 | | |
32 | | Process the file(s) with nfdump: |
33 | | |
34 | | nfdump -r /tmp/nfcap-test/nfcapd.201Ywwxxyyzz | less |
35 | | nfdump -r /tmp/nfcap-test/nfcapd.201Ywwxxyyzz -s srcip/bytes |
36 | | |
37 | | You should get some useful information :) |