netsniff-ng is a free Linux networking toolkit, a Swiss army knife for your daily Linux network plumbing if you will. Its gain of performance is reached by zero-copy mechanisms, so that on packet reception and transmission the kernel does not need to copy packets from kernel space to user space and vice versa.
Security Onion uses netsniff-ng to collect full packet capture in the form of pcap files.
HOSTNAMEis your actual hostname
INTERFACEis your actual sniffing interface
YYYY-MM-DDis the year, month, and date the pcap was recorded
Check the netsniff-ng.log file in
HOSTNAME is your actual hostname and
INTERFACE is your actual sniffing interface).
If sostat report packet loss in netsniff-ng, you may want to consider one or more of the following options in
--mmapto enable memory-mapped IO
Both of these options will cause netsniff-ng to consume more RAM.
Full packet capture obviously requires lots of disk space. Trimming your pcaps can allow you to store pcap for longer periods of time. For more information, please see the Trimming PCAPs section.