In order to save all the traffic into disks, the n2disk application has to be activated on an interface from which it is possible to capture all the traffic you are interested in. Once activated, n2disk will save the traffic data into the specified directory recycling the files already written, starting from the oldest one, this in case the maximum number of created files is reached.

In the following sections, we discuss all the n2disk 2.x command line options and how to efficiently configure n2disk to capture all the traffic flowing in your network.

Command Line Options

Below the available options and a detailed explanation of each option are listed:


[--interface|-i] <device>            | Ingress packet device.
[--active-wait|-g]                   | Active packet polling.
[--poll-duration|-q] <duration>      | Poll duration (usec). Lower more CPU is used,
                                     | better response time. Default: 1 usec.
[--snaplen|-s] <len>                 | Max packet capture length. Default: 1536.
[--packet-slicing] <header level>    | Slice packet after the specified header.
[--strip-header-bytes|-Y] <len>      | Strip the specified number of bytes from packet header.
[--sample-rate|-y] <rate>            | Packet sample rate (e.g. 100 means 1:100 sampling).
[--capture-direction|-2] <dir>       | Capture direction: 0=RX+TX, 1=RX only (default), 2=TX only
[--not-promisc|-3]                   | Do not set the interface in promiscuous mode.
[--dump-fcs]                         | Dump the Frame Check Sequence (FCS/CRC)


[--filter|-f] <filter>               | BPF (tcpdump-like) ingress packet filter.
[--fast-filter|-F] <filter>          | Faster replacement for BPF ingress packet filter.
[--l7-filter-conf] <conf file>       | FT configuration file for L7 filtering.


[--hw-timestamp|-J] <mode>           | Hardware timestamp packet strip. Supported modes:
                                     | ixia - Timestamped packets by hardware devices
                                     | NOTE: Silicom Hw TS NICs are supported automatically.
[--time-pulse|-S <id>]               | Enable time pulse thread (optimise sw packet timestamping)
                                     | and bind it to the specified core.
[--nanoseconds|-d]                   | Dump timestamps in nanosecond format.
[--no-timestamp|-T]                  | Do not compute timestamps.


[--chunk-len|-C] <len>               | Size (KB) of the chunk written to disk (must be
                                     | multiple of 4096). Default: 64 KB.
[--journaling|-j]                    | Enable journaling.
[--buffer-len|-b] <len>              | Buffer length (MBytes).
[--dump-directory|-o] <dir>          | Directory where dump files will be saved (multiple -o can be specified).
[--archive-directory|-O] <dir>       | Directory where dump files will be archived (slower
                                     | disks). The -a option is overwritten when using it.
[--max-file-len|-p] <len>            | Max pcap file length (MBytes).
[--max-file-duration|-t] <secs>      | Max pcap file duration (sec).
[--max-file-packets|-N] <num>        | Max packets per pcap file. Default: 0 (no max duration).
[--archive|-a]                       | Archive pcap file (rename to .old) instead
                                     | of overwriting if already present on disk.
[--disk-limit|-6] <size>             | Max amount of disk space to use (MBytes or %).
[--max-num-files|-m] <num>           | Max number of files before restarting file name.
[--max-nested-dirs|-n] <num>         | Max number of nested dump sub-directories.
[--file-prefix|-x] <prefix>          | Dump file prefix.
[--hugepages|-U]                     | Use hugepages for memory allocation.
[--disable-direct-io|-r]             | Disable Direct I/O (experts only).
[--stop-on-limit|-L]                 | Use max len/duration/packets as limit to stop capture.
[--remove-ahead|-H]                  | Delete in advance dumped files that will soon be
                                     | overwritten. Use this option to reduce file deletion cost.
[--pcap-compression|-M]              | Compress pcap files (produces .npcap compressed files)


[--index|-I]                         | Create pcap-index on-the-fly.
[--timeline-dir|-A] <dir>            | Time-arranged directory for produced pcaps and indexes.
[--extended-index|-E] <type>         | Extended index type: 1 - add per-packet timestamp.
[--index-tunnel-content|-G] <m>      | Compute index on tunnel content (GTP-U)
                                     | 1 - Index both inner and outer headers
                                     | 2 - Use inner header as outer header
[--index-on-compressor-threads|-Z]   | Compute index on the thread(s) used for compression (-z)
                                     | instead of using the capture thread(s).
[--exec-cmd] <cmd>                   | Execute the specified command when a pcap has been dumped.


[--reader-cpu-affinity|-c] <id>      | Bind the reader thread to the specified core.
[--writer-cpu-affinity|-w] <cores>   | Bind the writer thread(s) to the specified core ids.
                                     | A comma-separated list of cores (e.g. 0,1,2,3) should be
                                     | specified in case of multiple dump directories (-o).
[--compressor-cpu-affinity|-z] <ids> | Enable multithread compression and/or indexing and
                                     | bind thread(s) to the specified core ids (e.g. 0,1,2,3)
                                     | (mandatory with indexing on Napatech cards)

[--uburst-detection]                 | Enable microburst detection.
[--uburst-log]                       | Microbursts log file.
[--uburst-win-size] <usec>           | Window size for microburst check.
[--uburst-link-speed] <mbit/s>       | Link speed.
[--uburst-threshold] <percent>       | Traffic threshold (link speed percentage).

[--zmq <socket>]                     | Deliver stats to subscribers connected to the specified endpoint.
                                     | Example tcp://*:5556 or ipc://flows.ipc
[--zmq-probe-mode]                   | By default n2disk in ZMQ mode acts as a server with subscribers
                                     | (e.g. ntopng) attaching to it. When this option is used, roles are
                                     | reverted (i.e. use ntopng --zmq-collector-mode).
[--zmq-export-flows]                 | Export flows to ZMQ in addition to stats
[--zmq-encrypt-pwd <pwd>]            | Encrypt the ZMQ data using the specified password
[--zmq-disable-compression]          | Disable JSON compression via ZMQ (default: compress)


[--daemon]                           | Daemonize this app at startup
[--export-flow-offload] <cluster>    | Enable flows offload and export flows using an ipc queue
[--unprivileged-user|-u] <user>      | Use <user> instead of nobody when dropping privileges.
[--pid|-P] <path>                    | Save the pid into the specified path.
[--version|-V]                       | Print application version.
[--help|-h]                          | Help.
[--verbose|-v]                       | Verbose.
[--show-system-id]                   | Print the system identifier.
[--check-license]                    | Checks if the license is present and valid.
[--check-maintenance]                | Checks the maintenance status for the specified license
[--syslog|-l]                        | Dump trace messages to syslog.
[--event-log|-Q] <file>              | Save relevant events (i.e. drops) onto the specified file.

Basic example:

n2disk -i eth1 -o /storage -b 1024 -p 512 --disk-limit 50% -I -A /storage

For performance tuning please read the Tuning section.