netsnmp-pcap - SNMP extension which captures network traffic and reports the number of packets captured, and the throughput


    netsnmp-pcap [--config /etc/snmp/pcap.conf] [--debug [n]]
    netsnmp-pcap { --help | --man | --version }


Program options

-B, --base-oid OID

Specify the base OID to server the table from. Default to the same as bsnmpd-pcap, .

-c, --config path

Specify the path to the configuration file. Default to /etc/snmp/pcap.conf

-d, --debug [level]

Enable debug mode, i.e., traces POE events.

-D, --detach

Tell the program to detach itself from the terminal and become a daemon. Use --no-detach to prevent this.

-p, --pidfile path

Specify the path to a file to write the PID of the daemon.

Help options

-h, --help

Print a short usage description, then exit.


Print the manual page of the program, then exit.

-V, --version

Print the program name and version, then exit.


This program is a port of bsnmpd-pcap, the pcap plugin for FreeBSD's bsnmpd, as an AgentX for Net-SNMP, written in Perl. It allows you to measure arbitrary network traffic, in packets or octets, using the pcap(3) library. Multiple flows of traffic can be measured by setting as many network monitors, with different filters.


The counters are available as a table under the same OID as bsnmpd-pcap, but this can be changed using the --base-oid option:


The following entries are provided, where N is the index:


the number of network monitors present


the index of the network monitor


a human description of the netowrk monitor (may be empty)


the network device that traffic is being monitored on


the pcap(3) filter used to select certain network packets for monitoring


the number of octets seen by the monitor


the number of packets seen by the monitor


The configuration format is the same as bsnmpd-pcap, where you define the network monitors by setting the corresponding SNMP functions. Here is an example which defines three network monitors:

    pcapDescr.1  = "ARP, ICMP and VRRP traffic"
    pcapDevice.1 = "eth0"
    pcapFilter.1 = "arp or icmp or vrrp"

    pcapDescr.2  = "DNS traffic"
    pcapDevice.2 = "eth0"
    pcapFilter.2 = "port domain"

    pcapDescr.3  = "HTTP traffic"
    pcapDevice.3 = "eth0"
    pcapFilter.3 = "port http or port https"

and the corresponding result from snmpwalk:

    # snmpwalk -v2c -On -c public localhost .
    . = INTEGER: 3
    . = INTEGER: 1
    . = INTEGER: 2
    . = INTEGER: 3
    . = STRING: "ARP, ICMP and VRRP traffic"
    . = STRING: "DNS traffic"
    . = STRING: "HTTP traffic"
    . = STRING: "eth0"
    . = STRING: "eth0"
    . = STRING: "eth0"
    . = STRING: "arp or icmp or vrrp"
    . = STRING: "port domain"
    . = STRING: "port http or port https"
    . = Counter32: 56
    . = Counter32: 1347
    . = Counter32: 29137
    . = Counter32: 2
    . = Counter32: 15
    . = Counter32: 53
    End of MIB


Because this program is based on POE::Component::NetSNMP::agent, it suffers from the same problem, which is that when the snmpd daemon it is connected to dies, the default POE loop will spin over the half-closed Unix socket, eating 100% of CPU until the daemon is restarted and the sub-agent has reconnected. A workaround is to use an alternative event loop: POE::Loop::AnyEvent, POE::Loop::EV and POE::XS::Loop::EPoll have been tested to not expose this problem.

To select the event loop, set the POE_EVENT_LOOP environment variable to its name: POE_EVENT_LOOP=POE::Loop::AnyEvent


snmpd(1), bsnmpd-pcap(8), pcap(3), tcpdump(1)


Sebastien Aperghis-Tramoni (