Interactive commands

Without -c, NetOtter runs in interactive mode. It captures every 250 ms in the background and waits for your commands at the same time.

• Digits act at once: 1 to 9 turn capture on or off for that interface, and 0 stops every interface. No Enter is needed.
• Letters are typed with Enter. Their argument can follow on the same line: i 30, O capture, f port 443, r 2, e 1 & !2, n <text>,<name>.
• When it's left out, i, O, o, f, F, r and e ask for it on the next line (an id, a file name, a filter, an expression). Capture pauses while they wait: the frames wait in the system's buffer and are read afterwards, though a very busy link can fill it. On Windows, capture also pauses while you type any line; Npcap's buffer holds 8 MiB of frames.

Packets

Key	What it does
l	Lists the packets the active filters show, with their ids and capture times (seconds since the first packet). Lines end with tags: TCP flags ([SYN,ACK]), ARP and IGMP / MLD operations, DNS ([DNS NXDOMAIN]), ICMP ([port unreachable 192.0.2.10:514/udp]) and HTTP ([HTTP 404]), and in the analysis view the anomalies (!scan). With filters active, it ends with N of M packets shown (filters active) and the filter list.
i	Lists the packets, asks for an id, then shows that packet in detail: every header, the hostnames and the application in the analysis view, then a hexdump of everything after the IP header.
O	Asks for a file name and saves every packet there (.nto is added when the name has no extension).
o	Same, but saves only the packets the filters show.

Interfaces

Key	What it does
1 ... 9	Starts or stops capture on that interface.
0	Stops every interface. It prints No interface is listening when none was.

Filters

See Display filters for the filter names.

Key	What it does
f	Toggles one filter (f port 53): added if absent, removed if present.
F	Toggles a list of filters (F port 53, proto udp,,). Without one, reads filters, one or several per line (port 53, proto udp,), until a line starting with ,.
r	Removes the filter with that id (r 2). Without an id, lists the active filters with their ids and asks for one. This also removes half of a shortcut: one of the two filters port 53 adds.
p	Lists the active filters with their ids, and how they are combined (OR, AND or the expression).
e	Combines the filters by their ids with an expression (e 1 & (2 | 3) & !4). Without one, lists the filters with their ids and asks; an empty line drops the expression. f, F, r and c drop it too, since they change the ids. See Display filters.
c	Removes every filter.
m	Switches between OR (a packet matching any filter is shown) and AND (it must match every filter).
M	Lists your machine's addresses, the ones the me filters match, by interface.

f
Filter: port 53
Active filters (OR): portsrc 53, portdest 53
l
#19    [veth0]     4.322547  192.0.2.1:37647       -> 192.0.2.2:53          ttl 64  UDP     60 B  [DNS A?]
#20    [veth0]     4.322716  192.0.2.2:53          -> 192.0.2.1:37647       ttl 64  UDP     53 B  [DNS A 1 answer]
#23    [veth0]     4.649072  [2001:db8::1]:54081                             -> [2001:db8::2]:53                                hop 64  UDP     60 B  [DNS AAAA?]
#24    [veth0]     4.649400  [2001:db8::2]:53                                -> [2001:db8::1]:54081                             hop 64  UDP     65 B  [DNS AAAA 1 answer]
4 of 54 packets shown (filters active)
Active filters (OR): portsrc 53, portdest 53

Analysis view

See Analysis view.

Key	What it does
a	Switches between the classic view and the analysis view.
n <text>,<name>	Renames <text> to <name> in the l and i output of the analysis view, or replaces an existing renaming.
n <text>	Removes that renaming.
n	Lists the renamings.

Reverse DNS

See Reverse DNS and privacy.

Key	What it does
N	Switches between online and offline. Offline, NetOtter sends nothing.
d	Shows NetOtter's own DNS lookups since the last d (each query and answer with its bytes), after the stored answers no d has shown yet.
D	Shows every stored answer and the whole lookup log again. It doesn't change what the next d shows.

Anomalies

See Anomaly detection.

Key	What it does
s	Shows the traffic statistics: totals, top talkers, services and flows, hosts outside the local networks.
w	Shows every anomaly found, most severe first. f anomaly <kind> then lists their packets.

Other

Key	What it does
h	Prints the command list and the filter names again.
q	Quits. Ctrl-C and the end of the input (Ctrl-D) quit too. With -O or -o, the packets are saved first.

The interactive mode doesn't print the list when it quits (the CLI mode does): use l first.