Troubleshooting

Empty capture

Wrong port, capturing TLS, not root / no CAP_NET_RAW, or the wrong interface. Try --output-stdout, --verbose 1, --input-raw-ignore-interface, and HTTPS.

Missing requests or responses

pcap reconstructs TCP. Dropped packets in the kernel buffer look like truncated HTTP. Raise --input-raw-buffer-size (bytes; Linux default ~2MB). Example 10MB: --input-raw-buffer-size 10485760. --input-raw-allow-incomplete keeps partial messages. --input-raw-override-snaplen helps some VMs. Still broken: capture a pcap with tcpdump and file a GitHub issue.

Queue backups

--stats prints queue stats. TCP path: --output-tcp-stats every 5s as latest,mean,max,count,count/second. There is no --output-http-stats anymore. Raise --output-http-workers or --output-http-queue-len, or slow the input with |N.

CGO DNS crash

If you see unexpected signal during runtime execution in getaddrinfo, force Go DNS:

sudo GODEBUG="netdns=go" gor --input-raw :80 --output-http="http://staging.example.com"

too many open files

ulimit -n 64000

Linux sysctl tweaks from the old wiki (tcp_tw_recycle and friends) are often harmful on modern kernels — do not apply them blindly.

FAQ.