User guide

NetOtter captures the frames that reach your network interfaces and shows them as a list of decoded packets. You can inspect one packet, filter the list, name the hosts, and save everything to a .nto file to open later, on Linux or on Windows.

Pages

Page	What it covers
Installation	Building and installing on Linux and Windows, and the capture permission.
Getting started	Your first capture, in the interactive and the CLI mode.
Command-line options	Every option, with examples.
Interactive commands	Every key of the interactive mode.
Display filters	Showing only some packets: addresses, ports, protocols, "this machine".
Analysis view	Port names, hostnames, app categories and your own renamings.
Reverse DNS and privacy	The only packets NetOtter sends, how to see them and how to turn them off.
Save files	Saving and loading .nto captures, filtered or not.
Memory and limits	How long sessions stay out of RAM, and the limits.
Troubleshooting	Error messages and their fixes.

The two modes

• Interactive (the default): NetOtter captures in the background while you type commands. l lists the packets, i shows one in detail, and h lists every command.
• CLI (-c): NetOtter captures until you press Ctrl-C, then prints the list. With -I and no -i, it prints a saved capture right away. Use it in scripts.

What a packet line says

#28    [veth0]     4.968326  192.0.2.1:59682       -> 192.0.2.2:8080        ttl 64  TCP    119 B  [PSH,ACK]  [GET]

Part	Meaning
#28	The packet's id, used by i. Ids start at 1 and follow the capture order.
[veth0]	The interface it was captured on.
4.968326	When it was captured, in seconds since the first packet of the list (i shows the full date and time).
192.0.2.1:59682 -> 192.0.2.2:8080	Source and destination: address and port (IPv6 addresses are in brackets: [2001:db8::1]:43288). ARP packets show their MAC addresses instead.
ttl 64 / hop 64	IPv4 time to live, or IPv6 hop limit.
TCP	The protocol carried by IP (UDP, ICMP, ICM6...).
119 B	The bytes after the IP header: transport header plus data.
[PSH,ACK]	TCP flags. ARP, IGMP and MLD packets show what they do here, like [who-has 192.0.2.2 tell 192.0.2.1] or [join ff02::fb].
[GET]	What the data says, when NetOtter recognizes it: an HTTP request or status ([HTTP 404]), a DNS query or answer ([DNS A?], [DNS NXDOMAIN]), an ICMP message ([echo request], [port unreachable …]). In the analysis view, anomaly tags like !scan follow.