Command-line options

netotter [-h] [-v] [-l] [-c] [-i <ids>] [-I <file>] [-O <file> | -o <file>]
         [-f <filter> <value> ,] [-F <filter> <value> , ... ,] [-A]
         [-E <expression>] [-N]

Each option is its own argument: write -c -i 1, not -ci 1.

Option	What it does
-h	Prints the help and exits.
-v	Prints the version and the save format version, then exits: NetOtter r1.03.00 (save format v17).
-l	Prints the numbered interface list and exits. It takes precedence over every other option.
-i <ids>	Starts capturing on these interfaces, by id, separated by commas: -i 1,5. An unknown id is an error. Works in both modes.
-c	CLI mode: captures until Ctrl-C, then prints the packets. Needs -i or -I. With -I and no -i, prints the loaded file right away.
-I <file>	Loads a save file at startup. Any file name works: save files are recognized by their content.
-O <file>	Saves every packet to <file> when NetOtter exits. Adds .nto when the name has no extension.
-o <file>	Like -O, but saves only the packets the active filters show. -O and -o can't be combined.
-f <filter> <value> ,	Adds one display filter.
-F <filter> <value> , <filter> <value> , ,	Adds a list of filters, ended by an empty one (two commas in a row).
-A	Combines the filters with AND instead of OR.
-E <expression>	Combines the filters by their ids instead: -E "1 & (2 | 3) & !4". The ids count the -I file's filters first, then -f / -F. A wrong expression stops NetOtter with exit code 1. See Display filters.
-N	Offline mode: NetOtter sends nothing (no reverse DNS lookups). See Reverse DNS and privacy.
-T <file>	Trusted networks, one per line (192.0.2.0/24, 2001:db8::/32): hosts outside them are reported as foreign. See Anomaly detection.

Exit codes

Code	When
0	Normal exit, -h, -v, -l
1	An error after the options were read: unknown interface id, -c without -i or -I, unreadable or damaged -I file, invalid filter
other	An option error (unknown option, missing argument...), with a message on stderr

Errors are printed on stderr, prefixed by netotter:.

Filters on the command line

The separator is a comma, glued to the value or not. These are equivalent:

netotter -I capture.nto -c -f port 443,
netotter -I capture.nto -c -f port 443 ,

A list ends with an empty filter, that is two commas in a row:

netotter -I capture.nto -c -F port 443, ipv4 192.0.2.2,,

-f and -F can be repeated; the filters add up in order. They are applied after the filters stored in an -I file. NetOtter uses a comma rather than ~ because shells turn a lone ~ into your home folder. Display filters lists every filter.

Examples

# Capture on interfaces 2 and 3 in interactive mode, without sending anything
netotter -N -i 2,3

# Capture DNS only, until Ctrl-C, and save what was shown
netotter -c -i 3 -f port 53, -o dns

# Print the TCP packets of a capture that come from this machine (AND)
netotter -I capture.nto -c -A -F proto tcp, mesrc all,,

# Load a capture, filter it, and save a smaller copy
netotter -I capture.nto -c -f ipv4 192.0.2.2, -o server-only

-I and -O can't name the same file: NetOtter checks it before starting, so you can't overwrite the file you're reading.