How to capture a PCAP on Linux and Windows

Capture on Linux with tcpdump

Identify the interface and filter by host and port. `-s 0` retains complete packets and `-w` writes to a file.

sudo tcpdump -i eth0 -s 0 -C 100 -W 1 -w incident.pcap 'host 203.0.113.10 and port 443'

Related guide: How to run MTR and interpret loss and latency

Capture on Windows with Pktmon

Pktmon is included with modern Windows and records ETL that can be converted to PCAPNG for Wireshark. Run the console as administrator.

pktmon filter remove
pktmon filter add -p 443
pktmon start --capture --comp nics --pkt-size 0
# Reproduce the issue, then:
pktmon stop
pktmon etl2pcap PktMon.etl --out incident.pcapng

Reproduce, stop and document

Record time, timezone, IPs, application and exact action. Stop immediately after reproduction, verify that the file opens and use an approved sharing channel.

1. 01PrepareReduce unrelated traffic and define interface, filter, limit and safe destination.
2. 02ReproduceStart capture, run the affected flow once and record the time.
3. 03ReviewStop, open the file, verify the flow and remove or protect sensitive information.

Frequently asked questions

Sources

1. tcpdump manual
2. Wireshark User’s Guide — Capturing live network data
3. Microsoft Learn — Packet Monitor