The tcplog_dumper utility pulls data from the tcp_log device and writes it to disk. net/read_bbrlog can be use to read those pcapng files. WWW: https://github.com/Netflix/tcplog_dumper