pcapmirror

Capture network traffic on one machine and mirror it to another – straight into a running Wireshark, or to any collector that speaks TZSP or ERSPAN.

libpcap · BPF filters · TZSP & ERSPAN · IPv4 & IPv6

Download How to use it

Free and open source · Version 0.7 · Debian, Ubuntu, Rocky Linux, macOS, OpenBSD

A remote span port in one command

When you cannot run Wireshark where the traffic is, pcapmirror captures it there and sends it to where you are.

TZSP and ERSPAN

Packets are sent in TZSP over UDP (the default), or in ERSPAN type II over GRE with a session ID of your choice – the format switches and routers use for remote span ports.

BPF capture filters

Mirror only what you need with the same filter syntax as tcpdump and Wireshark, like tcp port 443 or host 10.0.0.5.

Made for Wireshark

Wireshark decodes TZSP and ERSPAN out of the box: start a capture on the receiving machine and the mirrored packets show up as if captured locally.

IPv4 and IPv6

Send TZSP to a host name, an IPv4 or an IPv6 address, and force either address family when a name resolves to both. ERSPAN goes over IPv4.

See what you send

Verbose mode decodes every mirrored packet – Ethernet, VLAN and QinQ, ARP, IPv4 and IPv6 with the well-known protocols. Or just count matching packets.

Small and portable

A single C program that only needs libpcap. Runs on Linux, macOS and OpenBSD, on servers, routers and Raspberry Pis.

Usage

pcapmirror needs root privileges (or the capture capability) to read from the interface.

Mirror web traffic to Wireshark

On the machine with the traffic, send everything on eth0 to TCP port 80 to 192.168.1.100:

sudo pcapmirror -i eth0 -f "tcp port 80" -r 192.168.1.100

On 192.168.1.100, capture in Wireshark with the capture filter udp dst port 37008 and make sure the firewall lets the UDP traffic in.

Send ERSPAN to a collector

ERSPAN needs the IPv4 source address of the GRE packets; the session ID defaults to 42:

sudo pcapmirror -e -i eth0 -s 192.0.2.10 -S 7 -r 192.0.2.50

In Wireshark, capture with the filter ip proto gre. Not sure which interfaces there are? pcapmirror -l lists them.

OptionDescription
-i <interface>Capture interface
-f <filter>Capture filter (BPF syntax)
-r <host>Destination host name, IPv4 or IPv6 address (required)
-p <port>Destination port (default 37008)
-eUse ERSPAN encapsulation (default TZSP)
-s <source_ip>Source IP address (required for ERSPAN)
-S <session_id>ERSPAN session ID, 0 to 1023 (default 42)
-4 / -6Force IPv4 or IPv6 host lookup
-lList the available network interfaces
-vVerbose: print every mirrored packet
-cCount matching packets (overrides -v)
-hShow the help

Download

Packages of the latest release, version 0.7. Older versions are on the releases page.

Debian

Debian package

For 64-bit PCs and servers (amd64).

Install with sudo apt install ./pcapmirror-*.deb, or use the apt repository for automatic updates.

Ubuntu

Ubuntu package

For 64-bit PCs and servers (amd64).

Install with sudo apt install ./pcapmirror-*.deb

Rocky Linux

RPM package

For Rocky Linux and other Enterprise Linux (x86_64).

Install with sudo dnf install ./pcapmirror-*.rpm

Homebrew (macOS and Linux)

brew install pcapmirror

From source

Needs a C compiler and libpcap (libpcap-dev on Debian, libpcap-devel on Rocky Linux). Get the source from git.freestone.net, then

make && sudo make install

Install from the apt repository

With the repository, pcapmirror is updated together with the rest of your system. Choose your Debian version:

  1. Download the key the packages are signed with:

    curl -fsSL https://packages.freestone.net/repo.asc | sudo tee /etc/apt/keyrings/packages.freestone.net.asc > /dev/null

  2. Save this as /etc/apt/sources.list.d/packages.freestone.net.sources:

    Types: deb
URIs: https://packages.freestone.net
Suites: bookworm
Components: main
Signed-By: /etc/apt/keyrings/packages.freestone.net.asc
    Types: deb
URIs: https://packages.freestone.net
Suites: trixie
Components: main
Signed-By: /etc/apt/keyrings/packages.freestone.net.asc
    Types: deb
URIs: https://packages.freestone.net
Suites: testing
Components: main
Signed-By: /etc/apt/keyrings/packages.freestone.net.asc
    Types: deb
URIs: https://packages.freestone.net
Suites: unstable
Components: main
Signed-By: /etc/apt/keyrings/packages.freestone.net.asc

    For example with sudo nano /etc/apt/sources.list.d/packages.freestone.net.sources. If you already set up the repository for another package from freestone.net, skip the first two steps.

  3. Install pcapmirror:

    sudo apt update
sudo apt install pcapmirror