| 21 | | $ mkdir /tmp/nfcap-test |
| 22 | | $ nfcapd -E -p 9001 -l /tmp/nfcap-test |
| 23 | | |
| 24 | | ... after a while, a series of flows should be dumped on your screen. |
| 25 | | |
| 26 | | Stop the tool with CTRL+C, then look at the contents of /tmp/nfcap-test |
| 27 | | |
| 28 | | $ ls -l /tmp/nfcap-test |
| 29 | | |
| 30 | | You should see one or more files called nfcapd.<YEAR><MON><DAY><HR><MIN> |
| 31 | | |
| 32 | | Process the file(s) with nfdump: |
| 33 | | |
| 34 | | nfdump -r /tmp/nfcap-test/nfcapd.201Ywwxxyyzz | less |
| 35 | | nfdump -r /tmp/nfcap-test/nfcapd.201Ywwxxyyzz -s srcip/bytes |
| 36 | | |
| 37 | | You should get some useful information :) |