capture_process
Capture network traffic from a specific process by PID, automatically filtering to the process's active connections for focused analysis.
Instructions
Capture network traffic from a specific process by its PID.
Snapshots the process's active connections at the moment capture starts, builds a BPF filter from those local ports, and captures only the matching traffic. New connections opened after capture starts share the same ports and are included automatically.
Use list_processes() to find the PID, and list_interfaces() to find the interface name.
Args: pid: Process ID to capture traffic for. interface: Network interface to capture on (from list_interfaces). output_pcap: Path where the captured PCAP will be saved. duration: Capture duration in seconds (default: 30, max: 60). packet_count: Maximum packets to capture (default: 200, max: 500). keylog_file: Optional TLS key log file path (SSLKEYLOGFILE format). When provided, decrypted TLS stream content is included in the output. The file must exist before calling this.
Returns: Capture summary showing detected connections, packet list, and (when keylog_file is supplied) decrypted TLS stream content.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| pid | Yes | ||
| duration | No | ||
| interface | Yes | ||
| keylog_file | No | ||
| output_pcap | Yes | ||
| packet_count | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |