# Does Suricata have the capability to save every packet or flow to a PCAP file in real time?

**URL:** <https://forum.suricata.io/t/does-suricata-have-the-capability-to-save-every-packet-or-flow-to-a-pcap-file-in-real-time/5787>\
**Category:** Help\
**Tags:** community\
**Created:** [June 19, 2025, 8:13am UTC](https://forum.suricata.io/t/does-suricata-have-the-capability-to-save-every-packet-or-flow-to-a-pcap-file-in-real-time/5787 "2025-06-19T08:13:19Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jasser\_Hach](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jasser_hach/32/3570_2.png) [@Jasser\_Hach](https://forum.suricata.io/u/Jasser_Hach)\
**Post date:** [June 19, 2025, 8:13am UTC](https://forum.suricata.io/t/does-suricata-have-the-capability-to-save-every-packet-or-flow-to-a-pcap-file-in-real-time/5787/1 "2025-06-19T08:13:19Z")

</div>

Additionally, can suricata forward this data to an external script for processing?

---

<div class="post-metadata">

**Author:** ![ACEKILLER-YOU](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/acekiller-you/32/3352_2.png) [@ACEKILLER-YOU](https://forum.suricata.io/u/ACEKILLER-YOU)\
**Post date:** [June 20, 2025, 3:51am UTC](https://forum.suricata.io/t/does-suricata-have-the-capability-to-save-every-packet-or-flow-to-a-pcap-file-in-real-time/5787/2 "2025-06-20T03:51:24Z")

</div>

It shouldn’t work. I have tried this idea. When the host performance is sufficient, Suricata seems to be able to record completely at the beginning, but later it seems not to be able to do so. At the beginning, it can record 100 pcaps a day, but after a week or even longer, it can only record 20 pcaps a day. The specific reason has not been analyzed yet, but it seems that there is a problem.

---

<div class="post-metadata">

**Author:** ![ish](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ish/32/8_2.png) [@ish](https://forum.suricata.io/u/ish)\
**Post date:** [June 20, 2025, 3:28pm UTC](https://forum.suricata.io/t/does-suricata-have-the-capability-to-save-every-packet-or-flow-to-a-pcap-file-in-real-time/5787/3 "2025-06-20T15:28:42Z")

</div>

Suricata has the `pcap-log` output. This records all traffic seen by Suricata to pcap files, much as if you were using another tool like `tcpdump` to do the same.

See [12.1. Suricata.yaml — Suricata 7.0.10 documentation](https://docs.suricata.io/en/suricata-7.0.10/configuration/suricata-yaml.html#packet-log-pcap-log) for more information.