rcapd --input-raw "<interface>" --input-raw-engine "pcap" --input-raw-bpf "tcp" --output-file network.pcap
rcapd --input-raw "<interface>" --input-raw-engine "pcap" --input-raw-bpf "tcp" --output-tcp <ip>:<port>
rcapd --input-tcp <ip>:<port> --output-file network.pcap
On linux it is possible to use --input-raw-engine
pfring