Capture at the useful boundary
Choose the point that can observe both sides of the question, not merely the nearest available interface.
Ecosystem overview
Traffic acquisition
Capture the right packets. Investigate what they prove.
Use a host tool, cloud mirror, virtual switch, SPAN, TAP, broker, or recorder to create the smallest authorized capture that contains the incident.
Host Cloud Network Recorder
ObserveUseful boundary
AcquireBounded PCAPinterface · filter · time
InvestigatePacketSafarievidence · verification · report
Start at the affected host
Capture without installing Wireshark.
Use operating-system capture tools where they are available. Tool availability and permissions vary by operating system, build, and enterprise policy.
01
Windowspktmon
- Install
- Built in
- Access
- Administrator
- Output
- ETL → PCAPNG
Capture at the affected host when installing Wireshark or a capture driver is not appropriate.
02Linuxtcpdump
- Install
- Commonly available
- Access
- root or capture capability
- Output
- PCAP / PCAPNG
Capture on the workload interface, with the smallest useful filter and incident window.
03macOStcpdump
- Install
- Built in
- Access
- sudo
- Output
- PCAP
Use the active interface and stop as soon as the reported behavior is represented.
Beyond the endpoint
Capture where the traffic is visible.
A host capture is not always the best evidence. Use the cloud, hypervisor, switching, visibility, or retention layer when that gives the investigation the correct boundary.
AWSVPC Traffic Mirroring or workload capture
Microsoft AzureNetwork Watcher or workload capture
VMwareVM capture or distributed-switch mirroring
Physical networkSwitch SPAN, passive TAP, or packet broker
Packet historyExport the incident window from a recorder
Mobile deviceCapture from the device, host, or controlled access point
Before you press start
A useful capture is deliberate.
PacketSafari can only investigate evidence present at the selected observation point. Encryption, asymmetric visibility, filters, slicing, packet loss, and an incomplete time window remain explicit limits.
Bound the incident window
Start just before reproduction and stop after the result. Smaller captures are easier to authorize, move, and investigate.
Preserve the evidence you need
Use filters or packet slicing only when they will not remove payload, timing, or protocol fields required by the investigation.
Handle packet data deliberately
Confirm authorization, retention, transfer, decryption, and sanitization requirements before sharing a capture.
Capture ready