diff --git a/docs/changes.txt b/docs/changes.txt
index a2c156c..13681ce 100644
--- a/docs/changes.txt
+++ b/docs/changes.txt
@@ -23,3 +23,4 @@ v0.1.5
 
 * nfqws2: # and % arg substitution
 * zapret-antidpi: luaexec
+* zapret-pcap: simple packet capture to .cap file
diff --git a/lua/zapret-lib.lua b/lua/zapret-lib.lua
index ae41c41..524c486 100644
--- a/lua/zapret-lib.lua
+++ b/lua/zapret-lib.lua
@@ -877,6 +877,20 @@ function genhost(len, template)
 	end
 end
 
+function is_absolute_path(path)
+	if string.sub(path,1,1)=='/' then return true end
+	local un = uname()
+	return string.sub(un.sysname,1,6)=="CYGWIN" and string.sub(path,2,2)==':'
+end
+function append_path(path,file)
+	return string.sub(path,#path,#path)=='/' and path..file or path.."/"..file
+end
+function writeable_file_name(filename)
+	if is_absolute_path(filename) then return filename end
+	local writedir = os.getenv("WRITEABLE")
+	if not writedir then return filename end
+	return append_path(writedir, filename)
+end
 
 -- arg : wsize=N . tcp window size
 -- arg : scale=N . tcp option scale factor
diff --git a/lua/zapret-pcap.lua b/lua/zapret-pcap.lua
new file mode 100644
index 0000000..b5b5310
--- /dev/null
+++ b/lua/zapret-pcap.lua
@@ -0,0 +1,22 @@
+-- test case : nfqws2 --qnum 200 --debug --lua-init=@zapret-lib.lua --lua-init=@zapret-pcap.lua:file=test.pcap --writeable=zdir
+-- arg : file=<filename> - file for storing pcap data. if --writeable is specified and filename is relative - append filename to writeable path
+function pcap(ctx, desync)
+	if not desync.arg.file or #desync.arg.file==0 then
+		error("pcap requires 'file' parameter")
+	end
+	local fn = writeable_file_name(desync.arg.file)
+	local f = io.open(fn, "a")
+	if not f then
+		error("pcap: could not write to '"..fn.."'")
+	end
+	local pos = f:seek()
+	if (pos==0) then
+		-- create pcap header
+		f:write("\xA1\xB2\x3C\x4D\x00\x02\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x65")
+	end
+	local raw = raw_packet(ctx)
+	local sec, nsec = clock_gettime();
+	f:write(bu32(sec)..bu32(nsec)..bu32(#raw)..bu32(#raw))
+	f:write(raw)
+	f:close()
+end
diff --git a/nfq2/lua.c b/nfq2/lua.c
index 948dbad..fd05393 100644
--- a/nfq2/lua.c
+++ b/nfq2/lua.c
@@ -188,6 +188,26 @@ static int luacall_u32(lua_State *L)
 	lua_pushinteger(L,pntoh32(p+offset));
 	return 1;
 }
+static int luacall_swap16(lua_State *L)
+{
+	lua_check_argc(L,"swap16",1);
+
+	lua_Integer i = luaL_checkinteger(L,1);
+	uint16_t u = (uint16_t)i;
+	if (i!=u) luaL_error(L, "out of range");
+	lua_pushinteger(L,__builtin_bswap16(u));
+	return 1;
+}
+static int luacall_swap32(lua_State *L)
+{
+	lua_check_argc(L,"swap32",1);
+
+	lua_Integer i = luaL_checkinteger(L,1);
+	uint32_t u = (uint32_t)i;
+	if (i!=u) luaL_error(L, "out of range");
+	lua_pushinteger(L,__builtin_bswap32(u));
+	return 1;
+}
 static int luacall_bu8(lua_State *L)
 {
 	lua_check_argc(L,"bu8",1);
@@ -548,7 +568,25 @@ static int luacall_uname(lua_State *L)
 	}
 	LUA_STACK_GUARD_RETURN(L,1)
 }
+static int luacall_clock_gettime(lua_State *L)
+{
+	lua_check_argc(L,"uname", 0);
 
+	LUA_STACK_GUARD_ENTER(L)
+
+	struct timespec ts;
+	if (clock_gettime(CLOCK_REALTIME, &ts))
+	{
+		lua_pushnil(L);
+		lua_pushnil(L);
+	}
+	else
+	{
+		lua_pushinteger(L, ts.tv_sec);
+		lua_pushinteger(L, ts.tv_nsec);
+	}
+	LUA_STACK_GUARD_RETURN(L,2)
+}
 static int luacall_instance_cutoff(lua_State *L)
 {
 	// out : func_name.profile_number[0]
@@ -2729,11 +2767,14 @@ static void lua_init_functions(void)
 		{"u16",luacall_u16},
 		{"u24",luacall_u24},
 		{"u32",luacall_u32},
-		// convert number to blob (string)
+		// convert number to blob (string) - big endian
 		{"bu8",luacall_bu8},
 		{"bu16",luacall_bu16},
 		{"bu24",luacall_bu24},
 		{"bu32",luacall_bu32},
+		// swap byte order
+		{"swap16",luacall_swap16},
+		{"swap32",luacall_swap32},
 
 		// integer division
 		{"divint",luacall_divint},
@@ -2762,6 +2803,7 @@ static void lua_init_functions(void)
 		// get raw packet data
 		{"raw_packet",luacall_raw_packet},
 		{"uname",luacall_uname},
+		{"clock_gettime",luacall_clock_gettime},
 
 		// convert table representation to blob or vise versa
 		{"reconstruct_tcphdr",luacall_reconstruct_tcphdr},