Capturing in PCAP Format

Use this information to configure the TimestampFormat and PacketDescriptor settings to capture frames in pcap format.

If you have not installed the Napatech libpcap during the Napatech driver installation, you must install it separately. For instructions, see DN-0428.

To verify that the Napatech libpcap is installed correctly, run the following command:

/opt/napatech3/bin/ntpcap_capture -l

The Napatech libpcap interfaces should appear as napa0, napa1, ... napaN as shown in the following output example.

…
List of capture interfaces:
0: napa0
1: napa1
2: napa2
3: napa3

This test is done using port 0 of the SmartNIC which is connected to the traffic generator.

Edit ntservice.ini file.
```
vim /opt/napatech3/config/ntservice.ini
```
The following shows the default TimestampFormat and PacketDescriptor configuration.
```
TimestampFormat = NATIVE_UNIX
PacketDescriptor = NT
```
The NT descriptor is used by default when the SmartNIC delivers frames to the host. To capture frames with a PCAP descriptor, set PacketDescriptor to PCAP.
```
PacketDescriptor = PCAP
```
As the PCAP descriptor can only be used with the PCAP or PCAP_NS time stamp format, set TimestampFormat to PCAP or PCAP_NS. For example:
```
TimestampFormat = PCAP
```
ntservice must be stopped and restarted for changes to take effect.
```
/opt/napatech3/bin/ntstop.sh
/opt/napatech3/bin/ntstart.sh
```
For more information on configuration parameters in the /opt/napatech3/config/ntservice.ini file, see ntservice ini file in DN-0449.

Start capture.

/opt/napatech3/bin/capture -p 0 -f test.pcap

where:

-p0: Specifies the port number. Captures frames that are received on port 0.
-f test.pcap: Specifies the file name. Stores received frames to the test.pcap file.

An output example:

The ports are located on a Capture profile.
Assigning traffic to stream 0
>>> : Assign[streamid=0;TxPort=0;TxNow=False]=Port==0
>>> : NT_NTPL returned id 4
Capturing using timeout = 1000 [ms] of NT_NetRxGet()
Capturing using segment interface.
Capturing to file "test.pcap"
Measuring PCIe throughput.
Throughput:    0.000 Mbps

Start transmitting frames on the traffic generator.

Stop capture.

An output example.

The ports are located on a Capture profile.
Assigning traffic to stream 0
>>> : Assign[streamid=0;TxPort=0;TxNow=False]=Port==0
>>> : NT_NTPL returned id 4
Capturing using timeout = 1000 [ms] of NT_NetRxGet()
Capturing using segment interface.
Capturing to file "test.pcap"
Measuring PCIe throughput.
^CThroughput:    0.000 Mbps
Delete the NTPL assigns.
>>> : Delete=4
Average throughput:   10.967 Mbps.

Total: 5 segments, 7988736 bytes, 0 bytes dropped, 0 packets dropped

Examine the generated test.pcap file using a libpcap application such as wireshark or tshark.
For example:
```
tshark -r test.pcap
```

Frames are captured and stored in a pcap file.