Sniffing using iptables

If you want to see full detail, please go to the Source.

Capture packets generated by user nobody to file nobody.pcap
# iptables -A OUTPUT -m owner --uid-owner nobody -j CONNMARK --set-mark 1
# iptables -A INPUT -m connmark --mark 1 -j NFLOG --nflog-group 30 
# iptables -A OUTPUT -m connmark --mark 1 -j NFLOG --nflog-group 30 
# dumpcap -i nflog:30 -w uid-1000.pcapCapture tcp packets from/to