Capturing flow templates with tcpdump
Sometimes, it is necessary to capture only flow templates. For example, when there are a lot of flows per second, only a few of them are required for analysis, and flow templates appear only once in 5 minutes. Capturing 5 minutes of traffic may generate a huge pcap while only templates and a few flows are useful. In such cases, only templates can be captured, and later on, the short pcap with flows.