Is there a program that can function like wireshark but instead of network traffic, capture raw sound and save it to a file?

I understand that network traffic is a protocol sandwich and that sound is not really analogous to it, but I draw the comparison with wireshark to highlight the operation.


  • Launch a user space program, ad-hoc.
  • Capture sound from a specific sound-card, or system-wide
  • Save this to a file for inspection, preferably raw Pulse Code Modulation (PCM)

I am not looking for any fidelity here, even a single channel sampled at 44Khz would be enough, heck even less than that would be fine.

Ultimately I want to be able to look at the captured data and perform my own analyses on it.

Similar but not quite

randomsound [1] looks similar to what I want, but it does its own analysis and only injects the entropy into the kernel randomness pool. It doesn't save the raw data.

Next, I looked at Audacity. This program allows me to capture the microphone stream, but not the stream of anything playing on the machine. So even if I were able to use command-line to start Audacity and capture a stream. It would not suffice as it is only able to capture the "input" devices.

[1] https://github.com/jimcrayne/randomsound


1 Answer 1


That would seem to be a very standard setup – what you're looking for is called a monitor device, and that's built-in into your sound system, PipeWire (or maybe still Pulseaudio, but they have the same interfaces, so that doesn't matter).

You can probably already use that: run

pactl list short sources

and look for these whose Name: field ends in .monitor`.

You can, out of the box, record that with parecord. Or, if you want to compress it right away, with ffmpeg:

ffmpeg \
     -f pulse \
     -i alsa_output.pci-0000_00_1b.0.analog-stereo.monitor \
     -c:a libopus -b:a 128k \

Where -f pulse tells ffmpeg to get the input from PulseAudio/PipeWire, -i {Device name} says from which device (as listed by pactl list short sources) , -c:a libopus uses the widely available and very good OPUS codec, and -b:a 128k sets the bitrate to 128 kb/s (which is usually indistinguishable from uncompressed audio).

Audacity: Problem Child

Audacity, at least in what I know, however doesn't fully support your modern sound system (which is a bit unfortunate, considering what it's used for).

We'll have to tell your system to emulate an actual audio hardware device. Luckily, that's not too hard.

Open the file .asoundrc in your home directory. It might not exist yet; just create it (e.g., using touch ~/.asoundrc).

Next, we find out the device we want to use: we filter the output of pactl list short sources, looking for lines with .monitor:

pactl list short sources | grep  '\.monitor'

From these devices that this lists for me, I want alsa_output.pci-0000_00_1b.0.analog-stereo.monitor; yours might be called differently. Copy that name.

Then, edit your ~/.asoundrc (in a text editor) and add:

pcm.analog_out_monitor {
  type pulse
  device alsa_output.pci-0000_00_1b.0.analog-stereo.monitor

ctl.analog_out_monitor {
  type pulse
  device alsa_output.pci-0000_00_1b.0.analog-stereo.monitor

(of course, use the name of your device where I used mine.)

Restart Audacity. You should see an input device analog_out_monitor now.

  • OK this looks is not as easy as running tcpdump. Tcpdump does the setup, capture, and save to file all in one application. Having said that, It fulfills my core requirement in terms of capturing and being able to save to raw format for further processing.
    – Aethalides
    Jun 10, 2023 at 12:55
  • 1
    Well as said, any pulseaudio or pipewire compatible program can also single-click select the monitor audio source, it's just that audacity is not Jun 10, 2023 at 14:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .