Getting started

1. Find your interface

netotter -l

1 - lo
2 - veth0

The number is the interface's id. Ids follow the system's interface list, so they can change when an interface appears or disappears (a VPN, a USB adapter, a reboot): run -l again when in doubt. On Windows, interfaces have names like ethernet_32769 or wireless_32768, followed by the adapter's description.

2. Capture interactively

netotter -i 2

NetOtter prints the interfaces and the commands, starts listening on interface 2, then waits for your commands while it captures:

Now listening on [veth0]
[veth0] fetched 4 packet(s)

Type l and Enter to list the packets captured so far:

#1     [veth0]     0.000000  ::                                              -> ff02::16                                        hop 1   ICM6    56 B  [2 groups]
#2     [veth0]     0.000056  ::                                              -> ff02::16                                        hop 1   ICM6    56 B  [2 groups]
#3     [veth0]     0.175110  ::                                              -> ff02::1:ff00:2                                  hop 255 ICM6    32 B  [neighbor solicitation]
...
#15    [veth0]     4.008620  00:00:5e:00:53:01     -> ff:ff:ff:ff:ff:ff             ARP      0 B  [who-has 192.0.2.2 tell 192.0.2.1]
#16    [veth0]     4.008652  00:00:5e:00:53:02     -> 00:00:5e:00:53:01             ARP      0 B  [192.0.2.2 is-at 00:00:5e:00:53:02]
#17    [veth0]     4.008658  192.0.2.1             -> 192.0.2.2             ttl 64  ICMP    64 B  [echo request]
#18    [veth0]     4.008682  192.0.2.2             -> 192.0.2.1             ttl 64  ICMP    64 B  [echo reply]
#19    [veth0]     4.322547  192.0.2.1:37647       -> 192.0.2.2:53          ttl 64  UDP     60 B  [DNS A?]
#20    [veth0]     4.322716  192.0.2.2:53          -> 192.0.2.1:37647       ttl 64  UDP     53 B  [DNS A 1 answer]

Each line has the packet's id, its interface, its capture time in seconds since the first packet, then its addresses, protocol and size, and what NetOtter recognized in it. The first packets are IPv6's own housekeeping when the cable came up (multicast reports, neighbour and router solicitations). Then come the ping (its ARP lookup, the request and the reply) and a DNS lookup.

Type i, then a packet id, to see one packet in detail:

Packet #20 on [veth0]
  Captured     2026-10-14 02:07:00.108239 (+4.322716 s)
  Ethernet     00:00:5e:00:53:02 -> 00:00:5e:00:53:01
  EtherType    IPv4 (0x0800)
  Source       192.0.2.2
  Destination  192.0.2.1
  Protocol     UDP  (17)
  TTL          64
  UDP header   8 bytes
    Ports      53 -> 37647
    Length     53
    Checksum   0x844a
  DNS          response #40488, NOERROR, 1 answer, question example.com (A)
  Data         looks like DNS
  Payload      53 bytes
  0000  00 35 93 0f 00 35 84 4a  9e 28 81 80 00 01 00 01  |.5...5.J.(......|
  0010  00 00 00 00 07 65 78 61  6d 70 6c 65 03 63 6f 6d  |.....example.com|
  0020  00 00 01 00 01 c0 0c 00  01 00 01 00 00 01 2c 00  |..............,.|
  0030  04 c0 00 02 02                                    |.....|

Captured is the full date and time. The DNS line is what NetOtter read in it while capturing, and the hexdump shows everything after the IP header: here the UDP header, then a DNS answer saying that example.com is 192.0.2.2. The DNS page decodes it byte by byte.

A few more keys to try:

• A digit from 1 to 9 turns capture on or off for that interface right away, with no Enter. 0 stops every interface.
• a switches to the analysis view: ports get names (53 becomes DNS), your own addresses become me, and servers get the names learned from DNS.
• f, then a filter on the next line such as port 53, shows only the matching packets. See Display filters.
• O, then a file name, saves everything to a .nto file. See Save files.
• h prints the command list again. q quits.

Interactive commands lists every key.

3. Capture from a script (CLI mode)

netotter -c -i 2 -O capture

Now listening on [veth0]
Capturing, Ctrl-C to stop
[veth0] fetched 4 packet(s)
[veth0] fetched 2 packet(s)
...
^C
#1     [veth0]     0.000000  ::                                              -> ff02::16                                        hop 1   ICM6    56 B  [2 groups]
...
Statistics: ...
No anomaly found in 54 packets
Saved 54 packets, 5 own addresses and 2 learned hostnames
Stopped listening on [veth0]

NetOtter captures until Ctrl-C, prints every packet, then the traffic statistics and the anomaly report, and saves them to capture.nto (it adds the extension). To read the file back:

netotter -I capture.nto -c          # print it
netotter -I capture.nto             # open it in interactive mode
netotter -I capture.nto -c -f port 53,   # print only the DNS packets

Next: Command-line options.