# kosa8 sandbox pcap

Capture a running sandbox's network traffic to a pcapng file

## Usage

```
kosa8 pcap SANDBOX [FILE]
```

Every frame the sandbox sends or receives is written, on the host, to a pcapng
file that opens in Wireshark or tshark. The guest cannot see, stop or edit it —
root in the guest included — because the capture is taken where the host's
userspace network reads each frame.

Rotation: FILE is the first segment. At --pcap-max-mb it closes and FILE.2.pcapng,
FILE.3.pcapng... follow; with --pcap-files N the oldest is deleted once N exist,
so the capture never holds more than N × max on disk. --pcap-files 1 keeps one
segment and stops when it is full, deleting nothing. Each closed segment's
SHA-256 is written to the audit log (action sandbox.pcap.segment).

A capture holds everything the guest said in the clear — tokens, cookies, keys
sent without TLS. The files are owner-only; treat them like the secrets they
may contain.

Stop with `kosa8 sandbox pcap SANDBOX --stop`; stopping the sandbox also ends it.

## Flags

| Flag | Type | What it does | Default |
|---|---|---|---|
| `--pcap-files` | int | segments kept on disk; the oldest is deleted beyond this (1 = stop when full) | `8` |
| `--pcap-max-mb` | int64 | size at which a capture segment closes and the next begins, in MiB | `64` |
| `--stop` | bool | stop the running capture |  |

## Example

```
  kosa8 sandbox pcap dev ./dev.pcapng
  kosa8 sandbox pcap dev --stop
  tshark -r dev.pcapng -Y dns
```

---
Source: https://docs.kosa8.com/reference/sandbox-pcap/