Save files

NetOtter saves captures in its own format, .nto. A save file holds the packets and what you need to read them again: the active filters, your renamings, your machine's addresses, and the names learned for the saved packets' addresses. The Linux and Windows versions read each other's files.

Saving

How	Saves	When
-O <file>	every packet	when NetOtter exits
-o <file>	the packets the filters show	when NetOtter exits
O, then a file name	every packet	right away
o, then a file name	the packets the filters show	right away

• File name: .nto is added when the name has no extension (-O capture writes capture.nto). The file is created readable by you only.
• Existing file: it's overwritten.
• -I and -O: they can't name the same file, so you can't overwrite the capture you're reading.

Saved 40 packets, 5 own addresses and 2 learned hostnames
Saved 7 of 40 packets, 1 filter, 5 own addresses and 2 learned hostnames

In a filtered save, the filters are saved too, and the packets get new ids (1, 2, 3...) when loaded. With no active filter, o saves everything, like O.

Loading

netotter -I capture.nto          # interactive
netotter -I capture.nto -c       # print and exit
netotter -I capture.nto -i 3     # load, then keep capturing on interface 3

Loaded 40 packets, 5 own addresses and 2 learned hostnames (saved by NetOtter r1.02.00 on Linux)

Files are recognized by their content, not by their name. Loading happens only at startup: there's no command to load a file during a capture, because the loaded packets would mix with the ones being captured.

After loading:

• Filters: the saved filters are active again, with their OR / AND mode. -f / -F apply on top of them, and -A replaces the saved mode.
• Renamings: your renamings are back.
• Addresses: the saved machine addresses join the current ones, so me still matches the addresses of the day of the capture (temporary IPv6 addresses change often). M marks them (from the file).
• Names: the saved names name the addresses again, offline too.

What a save carries, and what it doesn't

Saved	Not saved
every decoded header of each packet	the automatic me renamings (they're rebuilt)
the payloads, compressed when that helps	the reverse DNS cache as a whole
the active filters and their mode	names of addresses that no saved packet has
your renamings	the analysis / classic view choice
your machine's addresses
reverse DNS answers and learned hostnames for the saved packets' addresses

A filtered save keeps the names its packets need even when it leaves out the DNS or HTTPS packet the name was learned from. It never includes names of hosts that aren't in the file, so sharing a capture shows nothing more than its packets.

Errors

Message	Meaning
netotter: -I: unsupported save format v13 (this NetOtter reads v17 only)	The file comes from an older NetOtter. Each version reads its own format only (v17 today).
netotter: -I: not a NetOtter save file	The file doesn't start with NetOtter's signature.
netotter: -I: corrupted save file	The file is cut short or damaged.
netotter: <file>: not a regular file	-I named a folder, a device or a pipe.
netotter: -I and -O name the same file	Pick another output name.

The byte layout is described in Save format.