Question: what is ncap in linux?
Answer: ncap is a network capture utility like libpcap (on which it is based) and tcpdump. ... This utility is similar to tcpdump(1), but performs IP reassembly and generates framing-independent portable output. ncap is expected to be used for gathering continuous research or audit traces.