Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/pythops/oryx/llms.txt

Use this file to discover all available pages before exploring further.

Oryx can write a snapshot of all packets captured in the current session to a plain-text file. The export includes every packet in the in-memory buffer at the moment you trigger it — not just the packets currently visible in the Inspection section.

​
Triggering an export

Press s in the Inspection section, or press ctrl+s from anywhere in the application. If there are no packets in the current session, Oryx displays an info notification and does not create a file. On success, a notification confirms the destination path.

​
Output file location

Exported files are written to the ~/oryx/ directory with a timestamped filename: 
~/oryx/capture-YYYY-MM-DD_HH-MM
For example, an export triggered at 14:32 on 10 May 2026 produces: 
~/oryx/capture-2026-05-10_14-32
The ~/oryx/ directory is created automatically if it does not exist. File ownership is set to the invoking sudo user (read from SUDO_USER), not root, so you can read and manage the file without elevated privileges after Oryx exits.

​
File format

The export is a fixed-width plain-text table. The first line contains column headers, followed by a blank line, then one row per captured packet. 
Src Ip                                   Src Port     Dst Ip                                   Dst Port     Protocol      Pid           Date

192.168.1.10                             54321        93.184.216.34                            443          TCP           1234          2026-05-10 14:31:55
192.168.1.10                             -            224.0.0.1                                -            IGMP          -             2026-05-10 14:31:56

​
Column reference

ColumnDescription
Src IpSource IP address (or MAC address for ARP packets)
Src PortSource port number; - for protocols without ports
Dst IpDestination IP address (or MAC address for ARP packets)
Dst PortDestination port number; - for protocols without ports
ProtocolOne of: TCP, UDP, SCTP, ICMPv4, ICMPv6, IGMP, ARP
PidProcess ID, or - if not attributable to a process
DatePacket capture timestamp in YYYY-MM-DD HH:MM:SS format
All columns are space-padded to fixed widths to keep the output aligned.

Build docs developers (and LLMs) love

Get started for freeTalk to us