nsntrace - Man Page

nsntrace [options] program [arguments]

nsntrace uses Linux network namespaces to perform network traces of the specified program. The traces are stored as pcap files. And can later be analyzed by applications such as wireshark.

nsntrace creates a new network namespace and launches the specified program in it. This will ensure that all the packets we trace come from the system or the specified program.

To get around the isolation caused by the network namespace a virtual network interface is created. And in order for the program network traffic to reach the root network namespace iptables is used.

Since nsntrace uses iptables and traces raw sockets it needs to be run as root.

The following options are understood:

--device dev, -d dev

The network device to use in trace.

--use-public-dns

Override resolv.conf in namespace to use public nameservers from Quad9 (9.9.9.9), Cloudflare (1.1.1.1), Google (8.8.8.8) and OpenDNS (208.67.222.222).

--outfile file, -o file

Write the trace output to the file file. Default is nsntrace.pcap. Use '-' for stdout.

--user user, -u user

Run program with the user ID, group ID and supplementary groups of user.

--filter filter, -f filter

The capture filter to use while capturing. See pcap-filter(7) for filter syntax.

On success, 0 is returned; otherwise, a non-zero failure code is returned.

Jonas Danielsson <jonas@threetimestwo.org>