How to capture a PCAP on Linux and Windows
Safely capture PCAP or PCAPNG traffic with tcpdump on Linux and Pktmon on Windows, using filters and size limits without exposing unnecessary secrets.
Updated 7/30/20264 min read
Capture on Linux with tcpdump
Identify the interface and filter by host and port. `-s 0` retains complete packets and `-w` writes to a file.
sudo tcpdump -i eth0 -s 0 -C 100 -W 1 -w incident.pcap 'host 203.0.113.10 and port 443'Related guide: How to run MTR and interpret loss and latency
Capture on Windows with Pktmon
Pktmon is included with modern Windows and records ETL that can be converted to PCAPNG for Wireshark. Run the console as administrator.
pktmon filter remove
pktmon filter add -p 443
pktmon start --capture --comp nics --pkt-size 0
# Reproduce the issue, then:
pktmon stop
pktmon etl2pcap PktMon.etl --out incident.pcapngReproduce, stop and document
Record time, timezone, IPs, application and exact action. Stop immediately after reproduction, verify that the file opens and use an approved sharing channel.
- 01PrepareReduce unrelated traffic and define interface, filter, limit and safe destination.
- 02ReproduceStart capture, run the affected flow once and record the time.
- 03ReviewStop, open the file, verify the flow and remove or protect sensitive information.
Frequently asked questions
Are PCAP and PCAPNG the same?
Both store packets. PCAPNG supports richer metadata and multiple interfaces; Wireshark opens both.
Can I send a full capture to support?
Only when needed and through an approved channel. Filter first and assume payloads may contain credentials or third-party data.