Capturing network traffic in pcap/pcapng

The following are some common methods for capturing network traffic in PCAP or PCAPNG format.

Wireshark: Capture network traffic in pcap format

Wireshark provides a convenient way to capture network traffic and export it in PCAP format for further analysis.

To capture network traffic in PCAP using Wireshark:

  1. Identify the network interface card (NIC) on which network traffic will be captured. Select it and click the fin icon on the top left to start packet capture.

  2. Wait until a sufficient number of packets has been captured. Click the red square icon on the top left to stop packet capture.

  3. Select Save as: Wireshark/tcpdump/... - pcap, enter a file name, and click Save.

_images/usage-wiresharkstartcapture.png

Fig. 12 Start packet capture
_images/usage-wiresharkstopcapture.png

Fig. 13 Stop packet capture
_images/usage-wiresharksavepcap.png

Fig. 14 Save in pcap format

Wireshark: Capture network traffic in pcapng format

Wireshark provides a convenient way to capture network traffic and export it in PCAPNG format for further analysis.

To capture network traffic in PCAPNG using Wireshark:

  1. Identify the network interface card (NIC) on which network traffic will be captured. Select it and click the fin icon on the top left to start packet capture.

  2. Wait until a sufficient number of packets has been captured. Click the red square icon on the top left to stop packet capture.

  3. Select Save as: Wireshark/... - pcapng, enter a file name, and click Save.

_images/usage-wiresharkstartcapture.png

Fig. 15 Start packet capture
_images/usage-wiresharkstopcapture.png

Fig. 16 Stop packet capture
_images/usage-wiresharksavepcapng.png

Fig. 17 Save in pcapng format

tcpdump: Capture network traffic in pcap format

tcpdump is a CLI tool useful for capturing network traffic on headless Linux devices, such as Ubuntu Server environments, and can also be used in shell scripts for automated packet capture workflows.

To capture network traffic in PCAP using tcpdump:

  1. Run the following command to identify the network interface card (NIC) on which network traffic will be captured.

    ip addr

  2. Run the following command to begin a basic packet capture. Replace your_nic with the NIC from which traffic is captured. For additional packet capture configuration options, refer to the official tcpdump manual.

    sudo tcpdump -i your_nic -s 0 -w packets.pcap

  3. Wait until a sufficient number of packets has been captured. Press Ctrl + C to end network traffic capture.

_images/usage-linuxfindnic.png

Fig. 18 Finding your NIC

tshark: Capture network traffic in pcapng format

tShark is a terminal oriented version of Wireshark useful for capturing network traffic on headless Linux devices, such as Ubuntu Server environments, and can also be used in shell scripts for automated packet capture workflows.

To capture network traffic in PCAPNG using tcpdump:

  1. Run the following command to identify the network interface card (NIC) on which network traffic will be captured.

    ip addr

  2. Run the following command to begin a basic packet capture. Replace your_nic with the NIC from which traffic is captured. For additional packet capture configuration options, refer to the official tshark manual.

    sudo tshark -i your_nic -w /tmp/packets.pcapng

  3. Wait until a sufficient number of packets has been captured. Press Ctrl + C to end network traffic capture.

_images/usage-linuxfindnic.png

Fig. 19 Finding your NIC