cppcap Builderv0.2.3

Build Check Point cppcap capture commands (sk141412). A tcpdump-style capture tool with lower CPU load that also sees SecureXL-accelerated traffic. Built-in from R80.40; run from Expert mode.

// generated command

$ cppcap

// capture options

Interface (-i)

NOT captures on all interfaces except this one (-I)

Direction (-d)

Bytes per Frame (-c)

0 = capture full frame

Stop after Frames (-p)

Stop after Bytes (-b)

// output file

Output File (-o)

pcap readable by Wireshark · use default path · clear

Rotate at File Size (-w)

Suffix K, M, or G · plain number = bytes

Max Rotated Files (-W)

// screen output options

These flags only affect on-screen output — they are omitted from the command while an output file (-o) is set.

-D Verbose Datalink Layer (L2) data -N Verbose Network Layer (L3) data -T Verbose Transport Layer (L4) data -P Show processor ID -Q Remove timestamps

// vsx

Capture only VSID (-v)

Capture all except VSID (-V)

VSX / VSNext only · use -v or -V, not both

// capture filter (-f)

cppcap uses standard pcap-filter (BPF) syntax, the same as tcpdump.

Protocol

Additional BPF Expression

Appended verbatim with and. Accepts any valid BPF filter expression.