Troubleshooting

Capture

Error creating the eth linux sock / netotter: could not enable interface '3' (Linux)

NetOtter lacks the right to capture. Give the binary the cap_net_raw capability, as your user, not with sudo netotter:

sudo setcap cap_net_raw+ep "$(command -v netotter)"

make install does this for /usr/bin/netotter. Every rebuild of a local binary drops the capability, so set it again after each build. See Installation.

Error binding the socket to interface (Linux)

The interface disappeared between -l and the capture (a VPN went down, an adapter was unplugged), or its id changed. Run netotter -l again.

netotter: no interface with id '7'

Interface ids are positions in the current interface list: they change when interfaces come and go. Check them with netotter -l.

netotter: Npcap isn't installed, no capture (https://npcap.com) (Windows)

Install Npcap. NetOtter still runs without it, for .nto files.

Error opening [ethernet_32769]: permission denied (Npcap restricted to administrators? Run NetOtter as administrator) (Windows)

Npcap was installed with "Restrict Npcap driver's access to Administrators only". Run NetOtter as administrator, or reinstall Npcap without that option.

Loopback packets show up twice (Linux)

That's normal: on Linux, a capture on lo sees each packet once going out and once coming in. Windows shows them once.

Interfaces stopped by themselves

The packet list reached its RAM budget. See Memory and limits.

Command line

netotter: -c needs interfaces or a file, e.g. -c -i 1,5 or -c -I capture.nto

The CLI mode needs something to capture (-i) or to print (-I).

-ci doesn't work

Each option is its own argument: -c -i 1.

A filter isn't recognized

Filter names are lowercase (port, not PORT), and a filter ends with a comma on the command line (-f port 53,). See Display filters.

Save files

Message	Fix
unsupported save format vN (this NetOtter reads v13 only)	The file comes from an older NetOtter. Open it with the version that made it.
not a NetOtter save file	Wrong file.
corrupted save file	The file was cut short (a disk full, an interrupted copy) or damaged.
-I and -O name the same file	Choose another output name.

Reverse DNS

NetOtter sends DNS queries

It does so only in the analysis view, in online mode. Start with -N or press N to stop it. See Reverse DNS and privacy.

A message about reverse_dns.cache on startup

The cache file is damaged or comes from another version. NetOtter says what it does about it: it trims a half-written record, stops adding to the file, or ignores it. Deleting the file resets the cache.

Windows under Wine (developers)

Wine's wpcap.dll lists the interfaces but can't open them (no capture rights), so live capture can only be tested on Windows. Piping commands into wine NetOtter.exe runs no ticks between them, because Wine can't peek at a Unix pipe.