Performing Live Captures

Instead of loading files from disk, you can also use Netdude to capture them directly off one of the interfaces on your machine. You will need appropriate permissions -- usually root -- to do this. You can access the capture dialog through the "File -> Capture..." path. If you're lacking sufficient privileges, the menu item will be grayed out.

You can select the interface on which to listen in the upper part of the dialog, specify filters in the middle and select trace end conditions in the lower part. You can stop the capture after a given number of packets, limit the capture size, limit the capture time or all of the above. Additionally, you can choose to limit the amount of captured packets that are kept in memory to a given number. If you set this value to k, all packets snooped more than k packets ago are dropped, so the capture will not slowly eat up your machine's memory.

During the capture, you'll see some obvious statistical information updating in the bottom part of the dialog. You can stop the capture at any time using the buttons. Each started capture gets its own trace.