diff -Naur qemu-0.10.6/Makefile.target qemu-0.10.6-pcap/Makefile.target
--- qemu-0.10.6/Makefile.target	2009-07-16 20:56:21.000000000 -0400
+++ qemu-0.10.6-pcap/Makefile.target	2009-11-10 12:04:36.000000000 -0500
@@ -500,7 +500,8 @@
 # System emulator target
 ifndef CONFIG_USER_ONLY
 
-OBJS=vl.o osdep.o monitor.o pci.o loader.o isa_mmio.o machine.o dma-helpers.o
+OBJS=vl.o osdep.o monitor.o pci.o loader.o isa_mmio.o machine.o dma-helpers.o \
+     pcap.o
 # virtio has to be here due to weird dependency between PCI and virtio-net.
 # need to fix this properly
 OBJS+=virtio.o virtio-blk.o virtio-balloon.o virtio-net.o virtio-console.o
diff -Naur qemu-0.10.6/net.c qemu-0.10.6-pcap/net.c
--- qemu-0.10.6/net.c	2009-07-16 20:56:24.000000000 -0400
+++ qemu-0.10.6-pcap/net.c	2009-11-10 12:18:44.000000000 -0500
@@ -120,6 +120,8 @@
 #define memalign(align, size) malloc(size)
 #endif
 
+#include "pcap.h"
+
 static VLANState *first_vlan;
 
 /***********************************************************/
@@ -496,6 +498,7 @@
     printf("slirp output:\n");
     hex_dump(stdout, pkt, pkt_len);
 #endif
+    pcap_dump(pkt, pkt_len);
     if (!slirp_vc)
         return;
     qemu_send_packet(slirp_vc, pkt, pkt_len);
@@ -512,6 +515,7 @@
     printf("slirp input:\n");
     hex_dump(stdout, buf, size);
 #endif
+    pcap_dump(buf, size);    
     slirp_input(buf, size);
 }
 
diff -Naur qemu-0.10.6/pcap.c qemu-0.10.6-pcap/pcap.c
--- qemu-0.10.6/pcap.c	1969-12-31 19:00:00.000000000 -0500
+++ qemu-0.10.6-pcap/pcap.c	2009-11-10 12:18:54.000000000 -0500
@@ -0,0 +1,61 @@
+#include <assert.h>
+#include <stdio.h>
+#include <sys/time.h>
+#include <time.h>
+
+#include "pcap.h"
+
+static int started = 0;
+static FILE *cap_file;
+
+static void
+pcap_write(const char *b, int l) {
+	size_t c = fwrite(b, 1, l, cap_file);
+	assert(c == l);
+	fflush(cap_file);
+}
+
+void
+pcap_dump_init(const char *fname) {
+	pcap_hdr_t pcap_hdr;
+
+	if (!fname)
+		fname = "slirp.cap";
+
+	cap_file = fopen(fname, "wb");
+	if (!cap_file) {
+		perror("pcap_dump_init:");
+		return;
+	}
+
+	pcap_hdr.magic_number = PCAP_MAGIC;
+	pcap_hdr.version_major = PCAP_VMAJOR;
+	pcap_hdr.version_minor = PCAP_VMINOR;
+	pcap_hdr.thiszone = 0;
+	pcap_hdr.sigfigs = 0;
+	pcap_hdr.snaplen = 65535;
+	pcap_hdr.network = 1; // Ethernet
+
+	pcap_write((char *)&pcap_hdr, sizeof(pcap_hdr));
+
+	started = 1;
+}
+
+void
+pcap_dump(const uint8_t *pkt, int len) {
+	pcaprec_hdr_t pkt_hdr;
+	struct timeval tv;
+
+	if (!started)
+		return;
+
+	gettimeofday(&tv, 0);
+
+	pkt_hdr.ts_sec = tv.tv_sec;
+	pkt_hdr.ts_usec = tv.tv_usec;
+	pkt_hdr.incl_len = len;
+	pkt_hdr.orig_len = len;
+
+	pcap_write((char *)&pkt_hdr, sizeof(pkt_hdr));
+	pcap_write(pkt, len);
+}
diff -Naur qemu-0.10.6/pcap.h qemu-0.10.6-pcap/pcap.h
--- qemu-0.10.6/pcap.h	1969-12-31 19:00:00.000000000 -0500
+++ qemu-0.10.6-pcap/pcap.h	2009-11-10 12:18:56.000000000 -0500
@@ -0,0 +1,34 @@
+#ifndef _PCAP_H_
+#define _PCAP_H_
+
+#include "qemu-common.h"
+
+/*
+ * Used http://wiki.wireshark.org/Development/LibpcapFileFormat to get the pcap file format
+ */
+
+#define PCAP_MAGIC	0xa1b2c3d4
+#define PCAP_VMAJOR	2
+#define PCAP_VMINOR	4
+
+typedef struct pcap_hdr_s {
+	uint32_t magic_number;   /* magic number */
+	uint16_t version_major;  /* major version number */
+	uint16_t version_minor;  /* minor version number */
+	int32_t  thiszone;       /* GMT to local correction */
+	uint32_t sigfigs;        /* accuracy of timestamps */
+	uint32_t snaplen;        /* max length of captured packets, in octets */
+	uint32_t network;        /* data link type */
+} pcap_hdr_t;
+
+typedef struct pcaprec_hdr_s {
+	uint32_t ts_sec;         /* timestamp seconds */
+	uint32_t ts_usec;        /* timestamp microseconds */
+	uint32_t incl_len;       /* number of octets of packet saved in file */
+	uint32_t orig_len;       /* actual length of packet */
+} pcaprec_hdr_t;
+
+void pcap_dump_init(const char *fname);
+void pcap_dump(const uint8_t *pkt, int len);
+
+#endif //_PCAP_H_