When debugging network behavior or analyzing application communications, we often need to capture traffic generated by a specific command while excluding background processes. Traditional packet sniffers like tcpdump capture all interface traffic, making it difficult to isolate packets from a single process.

The most effective native approach uses Linux network namespaces to create isolated networking environments:

# Create a new network namespace
sudo ip netns add testns

# Run command in the namespace
sudo ip netns exec testns bash -c "wget http://example.com && tcpdump -i any -w command_traffic.pcap"

For simpler cases where you just need to identify network connections rather than full packet capture:

strace -f -e trace=network -o network_calls.log wget http://example.com

This specialized tool creates temporary network namespaces automatically:

# Installation
sudo apt install nsntrace

# Usage
nsntrace -o command_traffic.pcap wget http://example.com

For containerized environments, we can combine namespace techniques:

# Find container's network namespace
container_id=$(docker inspect --format '{{.State.Pid}}' container_name)

# Capture traffic using the container's namespace
sudo nsenter -t $container_id -n tcpdump -i eth0 -w container_traffic.pcap

When dealing with high-traffic applications, consider these optimizations:

• Use BPF filters to reduce capture volume: tcpdump -i any 'port 80'
• Limit capture duration with -G and -W flags
• For production systems, consider perf with network probes

When debugging network-related issues or analyzing application behavior, we often need to capture network traffic generated by a specific command while excluding background noise. Traditional tools like tcpdump or wireshark capture all traffic on an interface, making it difficult to isolate traffic from a single process.

Here are three effective approaches to achieve command-specific packet capture:

# Method 1: Using nsenter with tcpdump
sudo nsenter -t $(pgrep -f "your_command") -n tcpdump -w output.pcap

# Method 2: Using strace + tcpdump
strace -f -e trace=network command_to_monitor 2>&1 | grep -E 'connect|send|recv'

# Method 3: Using network namespaces
sudo ip netns add testns
sudo ip netns exec testns command_to_monitor &
sudo ip netns exec testns tcpdump -i any -w output.pcap

This is the most reliable approach for complete isolation:

# Create a new network namespace
sudo ip netns add command-ns

# Create veth pair
sudo ip link add veth0 type veth peer name veth1

# Move one end to the namespace
sudo ip link set veth1 netns command-ns

# Configure IP addresses
sudo ip addr add 10.0.0.1/24 dev veth0
sudo ip netns exec command-ns ip addr add 10.0.0.2/24 dev veth1

# Bring interfaces up
sudo ip link set veth0 up
sudo ip netns exec command-ns ip link set veth1 up

# Start capture in background
sudo ip netns exec command-ns tcpdump -i any -w command-traffic.pcap &

# Run your command in the namespace
sudo ip netns exec command-ns /bin/bash -c "your_command_here"

# When done, clean up
sudo ip netns del command-ns
sudo ip link del veth0

Let's capture traffic from a simple wget command:

#!/bin/bash

# Create temporary namespace
NETNS="temp-$(date +%s)"
sudo ip netns add $NETNS

# Setup capture
sudo ip netns exec $NETNS tcpdump -i lo -w wget-capture.pcap &
TCPDUMP_PID=$!

# Give tcpdump time to start
sleep 1

# Run wget in namespace
sudo ip netns exec $NETNS wget -O /dev/null http://example.com

# Stop capture
sudo kill $TCPDUMP_PID

# Cleanup
sudo ip netns del $NETNS

# Analyze results
tcpdump -r wget-capture.pcap

For simpler use cases, consider these alternatives:

• ltrace: Trace library calls including network-related ones
• strace: Trace system calls including socket operations
• nethogs: Per-process network traffic monitor

Remember these limitations:

• Some commands might fail in isolated namespaces if they depend on specific network configurations
• SSL/TLS traffic will be encrypted unless you configure MITM proxies
• The command might spawn child processes that need to be accounted for