How to capture packets

PacketSafari Analyzer does not record traffic itself. Capture on the device or tap that sees the traffic, save a .pcap or .pcapng, and upload it to the analyzer. Our capture guides list playbooks for common scenarios.

Recommended capture tools

• Dumpcap (cross-platform). Ships with Wireshark; low overhead CLI that is ideal for long captures and ring buffers.
• tcpdump (cross-platform). Ubiquitous command-line capture with BPF filters for quick, targeted traces.
• Wireshark (cross-platform). Friendly UI for on-the-spot captures and protocol validation.
• Packet Monitor / pktmon (Windows). Built-in Windows capture tool: Microsoft pktmon guide

Capture tips

• Prefer .pcapng for richer metadata (comments, interface info, TLS keys).
• Capture the full handshake when you plan to decrypt TLS (enable SSLKEYLOGFILE on the client).
• If sensitive payloads are present, capture with slicing or anonymize before uploading (see the next section).
• Keep notes on where the tap was placed; the capture point visualization relies on TTL and RTT hints to infer the path.