# Which capture mode am I running in?

**URL:** <https://forum.suricata.io/t/which-capture-mode-am-i-running-in/979>\
**Category:** Help\
**Created:** [January 15, 2021, 5:22pm UTC](https://forum.suricata.io/t/which-capture-mode-am-i-running-in/979 "2021-01-15T17:22:30Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Zaxxon](https://avatars.discourse-cdn.com/v4/letter/z/3be4f8/32.png) [@Zaxxon](https://forum.suricata.io/u/Zaxxon)\
**Post date:** [January 15, 2021, 5:22pm UTC](https://forum.suricata.io/t/which-capture-mode-am-i-running-in/979/1 "2021-01-15T17:22:30Z")

</div>

I’m running Suricata 6.0.1 in IDS mode on CentOS 7 (kernel 3.10.0-1160.6.1.el7.x86\_64) and I specify “-i p1p2” on the command line. I believe the docs say Suricata will pick the best available method of capture with the -i switch. Is there something in the suricata log file that says whether I am in pcap or af-packet mode?

---

<div class="post-metadata">

**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\
**Post date:** [January 16, 2021, 2:19pm UTC](https://forum.suricata.io/t/which-capture-mode-am-i-running-in/979/2 "2021-01-16T14:19:07Z")

</div>

Hi,  
Welcome to the community!

You can use `suricatasc` to retrieve the `capture mode` (and `run mode`).

To retrieve the capture mode:

```auto
 $ sudo python3 python/bin/suricatasc -c "capture-mode" /usr/local/var/run/suricata/suricata-command.socket
{"message": "AF_PACKET_DEV", "return": "OK"}

```

Suricata’s log will contain the pathname to the socket – use:

```auto
$ grep "socket file" /tmp/ll/suricata.log
[4153763] 16/1/2021 -- 09:10:58 - (unix-manager.c:132) <Info> (UnixNew) -- Using unix socket file '/usr/local/var/run/suricata/suricata-command.socket'

```

---

<div class="post-metadata">

**Author:** ![Zaxxon](https://avatars.discourse-cdn.com/v4/letter/z/3be4f8/32.png) [@Zaxxon](https://forum.suricata.io/u/Zaxxon)\
**Post date:** [January 19, 2021, 3:00pm UTC](https://forum.suricata.io/t/which-capture-mode-am-i-running-in/979/3 "2021-01-19T15:00:01Z")

</div>

Thanks for the help Jeff! Using the Centos 7 pre-built package provided by OISF, I was able to get the info via the following method:

~# /usr/bin/suricatasc -c “capture-mode” /var/run/suricata/suricata-command.socket

{“message”: “AF\_PACKET\_DEV”, “return”: “OK”}