.. |br| raw:: html

   <br />

.. _h2-capturing-pcap:

####################################################################
Capturing network traffic in pcap/pcapng
####################################################################

The following are some common methods for capturing network traffic in PCAP or PCAPNG format.

 **In This Section**
   #. :ref:`Wireshark: Capture network traffic in pcap format <wireshark-pcap>`
   #. :ref:`Wireshark: Capture network traffic in pcapng format <wireshark-pcapng>`
   #. :ref:`tcpdump: Capture network traffic in pcap format <tcpdump-pcap>`
   #. :ref:`tshark: Capture network traffic in pcapng format <tshark-pcapng>`

----

.. _wireshark-pcap:

Wireshark: Capture network traffic in pcap format
========================================================================================

Wireshark provides a convenient way to capture network traffic and export it in PCAP format for further analysis.

To capture network traffic in PCAP using Wireshark:

   #. Identify the network interface card (NIC) on which network traffic will be captured. Select it and click the fin icon on the top left to start packet capture.
   #. Wait until a sufficient number of packets has been captured. Click the red square icon on the top left to stop packet capture.
   #. Select ``Save as: Wireshark/tcpdump/... - pcap``, enter a file name, and click ``Save``.

.. list-table::
   :widths: 33 33 33
   :class: borderless

   * - .. figure:: _static/usageImgs/usage-wiresharkstartcapture.png
          :width: 100%
          :align: center

          Start packet capture

     - .. figure:: _static/usageImgs/usage-wiresharkstopcapture.png
          :width: 100%
          :align: center

          Stop packet capture

     - .. figure:: _static/usageImgs/usage-wiresharksavepcap.png
          :width: 100%
          :align: center

          Save in pcap format

----

.. _wireshark-pcapng:

Wireshark: Capture network traffic in pcapng format
========================================================================================

Wireshark provides a convenient way to capture network traffic and export it in PCAPNG format for further analysis.

To capture network traffic in PCAPNG using Wireshark:

   #. Identify the network interface card (NIC) on which network traffic will be captured. Select it and click the fin icon on the top left to start packet capture.
   #. Wait until a sufficient number of packets has been captured. Click the red square icon on the top left to stop packet capture.
   #. Select ``Save as: Wireshark/... - pcapng``, enter a file name, and click ``Save``.

.. list-table::
   :widths: 33 33 33
   :class: borderless

   * - .. figure:: _static/usageImgs/usage-wiresharkstartcapture.png
          :width: 100%
          :align: center

          Start packet capture

     - .. figure:: _static/usageImgs/usage-wiresharkstopcapture.png
          :width: 100%
          :align: center

          Stop packet capture

     - .. figure:: _static/usageImgs/usage-wiresharksavepcapng.png
          :width: 100%
          :align: center

          Save in pcapng format

----

.. _tcpdump-pcap:

tcpdump: Capture network traffic in pcap format
========================================================================================

tcpdump is a CLI tool useful for capturing network traffic on headless Linux devices, such as Ubuntu Server environments, and can also be used in shell scripts for automated packet capture workflows.

To capture network traffic in PCAP using tcpdump:

   #. Run the following command to identify the network interface card (NIC) on which network traffic will be captured.

      .. code-block:: text

	       ip addr

   #. Run the following command to begin a basic packet capture. Replace ``your_nic`` with the NIC from which traffic is captured. For additional packet capture configuration options, refer to the official `tcpdump manual <https://www.tcpdump.org/manpages/tcpdump.1.html>`_.


      .. code-block:: text

	       sudo tcpdump -i your_nic -s 0 -w packets.pcap

   #. Wait until a sufficient number of packets has been captured. Press ``Ctrl + C`` to end network traffic capture.

.. figure:: _static/usageImgs/usage-linuxfindnic.png
   :width: 100%
   :align: center

   Finding your NIC

----

.. _tshark-pcapng:

tshark: Capture network traffic in pcapng format
========================================================================================

tShark is a terminal oriented version of Wireshark useful for capturing network traffic on headless Linux devices, such as Ubuntu Server environments, and can also be used in shell scripts for automated packet capture workflows.

To capture network traffic in PCAPNG using tcpdump:

   #. Run the following command to identify the network interface card (NIC) on which network traffic will be captured.

      .. code-block:: text

	       ip addr

   #. Run the following command to begin a basic packet capture. Replace ``your_nic`` with the NIC from which traffic is captured. For additional packet capture configuration options, refer to the official `tshark manual <https://www.wireshark.org/docs/man-pages/tshark.html>`_.

      .. code-block:: text

	       sudo tshark -i your_nic -w /tmp/packets.pcapng

   #. Wait until a sufficient number of packets has been captured. Press ``Ctrl + C`` to end network traffic capture.

.. figure:: _static/usageImgs/usage-linuxfindnic.png
   :width: 100%
   :align: center

   Finding your NIC