iptables -A OUTPUT -m owner --gid-owner nflog -j CONNMARK --set-mark 1 iptables -A INPUT -m connmark --mark 1 -j NFLOG --nflog-group 30 iptables -A OUTPUT -m connmark --mark 1 -j NFLOG --nflog-group 30 sudo -g nflog /usr/bin/application dumpcap -i nflog:30 -w uid-1000.pcap