outboundctl capture

outboundctl capture records network traffic to and from one host into a .pcapng file, for example when support asks for one. It records only that host, for a limited time and size. In the app, Capture Traffic prepares the same command for you.

outboundctl capture --host <host> --out </path/file.pcapng> [--interface en0] [--port <port>] [--duration 60] [--max-mb 50] [--run]

Preview first

Without --run, the command only prints what it would do: a warning, the exact command to run, and the tcpdump command it would supervise. Nothing is recorded. Read the command, then run it as printed with administrator privileges; --run without sudo stops with “Run the printed command with administrator privileges.” (exit 77).

Caution

Packet captures can contain private payloads, credentials and personal data. Share them only with someone you trust.

Limits

Option	Default	Allowed
--host	(required)	One host name or IP address. Filter expressions are not accepted
--out	(required)	An absolute path ending in .pcapng
--interface	en0	A network interface name
--port	any	1 to 65535
--duration	60 seconds	1 to 600 seconds
--max-mb	50 MB	1 to 500 MB

The capture stops at whichever limit it reaches first, even when no traffic arrives, and when you press Control-C. It then prints how many bytes it saved.