Packet capture

Packet capture is optional. It needs a build with packet-capture support and a system packet-capture library.

Requirements

Platform	Runtime requirement
Windows	Npcap installed.
Linux	libpcap installed and capture permissions granted.
macOS	libpcap available and capture permissions granted where required.

If the desktop build does not include packet capture support, the Packet Capture tool is hidden. If support is included but the runtime library or permissions are missing, NetsCLI keeps the rest of the app usable and shows setup guidance for packet capture.

CLI Capture

Check packet-capture support and list available capture devices:

netscli pcap --check

Capture from an interface:

netscli pcap --interface "Eth 2.5G" --duration 5 --max-packets 1000

Parse an existing capture file:

netscli pcap --read capture.pcap --max-packets 100

Important options:

Option	Purpose
--check	Check packet-capture support and list capture devices.
--interface	Capture interface name.
--read	Parse an existing PCAP file instead of capturing live traffic.
--duration	Capture duration in seconds.
--max-packets	Maximum packet count before stopping.
--filter	Optional capture filter when supported.
--output	Output file for live captures.

Parsed Output

NetsCLI summarizes captured packets into practical rows:

• Number
• Time
• Source
• Destination
• Protocol
• Length
• Info

Details can include parsed Ethernet, IP, TCP, UDP, ICMP, or ARP fields when the packet parser recognizes them, plus a bounded hex preview.

Desktop Behavior

The desktop app uses a dedicated Packet Capture tab when the feature is available.

Expected workflow:

1. Choose an interface from the available interface list.
2. Set duration, max packet count, and optional filter.
3. Start capture.
4. Review parsed packet rows as the primary result.
5. Inspect selected packet fields and raw preview in the details pane.
6. Open the capture file or containing folder when a file was written.

Save behavior follows the global save settings: default save folder or ask where to save.

What it is not

NetsCLI packet capture is not a Wireshark replacement. It is intended for quick local inspection, scripting, and lightweight result review. Use Wireshark or tshark for deep protocol dissection, packet coloring rules, stream reassembly, and advanced display filters.

Troubleshooting

• On Windows, install Npcap if capture fails with a missing wpcap.dll or similar runtime error.
• On Linux, confirm libpcap is installed and the user has capture permissions.
• Confirm the selected interface name matches the operating system interface list.
• Start with short captures and simple filters before increasing packet volume.