To start sniffing, run the sniff subcommand with the serial port of your sniffer device (replace <serial_port> with your port, for example COM3 or /dev/ttyACM0):
nrfutil ble-sniffer sniff --port <serial_port>
The sniff subcommand writes captured packets to a PCAP file in the current working directory.