Packet Captures (tcpdump)

Automator can capture network packets during a study using tcpdump. The setup script and the Docker image set this up for you.

To allow a capture on a machine that was not set up by the script, install tcpdump and give it the required permissions:

sudo apt update -qq && sudo apt install tcpdump
sudo setcap cap_net_raw,cap_net_admin=eip $(command -v tcpdump)

Package upgrades reset capture permissions

Run the setcap command again after upgrading the tcpdump package.

Creating a Capture

surfmeter study start --studyId STUDY_YOUTUBE --enableTcpDump

This records data on any interface, and writes it to a PCAP file in ~/.surfmeter/pcaps/. Use --tcpDumpDir to set a different directory.

Tip

The metadata.surfmeter.tcpDumpFilename field in the report contains the PCAP file name. It is also available through the API.

Reading a Capture

On Debian and Ubuntu, AppArmor does not let tcpdump read files in ~/.surfmeter. Read a capture like this, or open it in Wireshark:

tcpdump -r - < file.pcap