Skip to main content
Back to Category

How to Capture Packets (PCAP) and Submit to Support

Packet capture guide using Linux tcpdump and Windows Wireshark. Create PCAP files for network analysis, troubleshoot connectivity issues, and submit to support.

Read time: 7 min Troubleshooting
pcaptcpdumpwiresharkpacket capturenetwork analysistroubleshootingnetwork
Author
REXE Teknoloji Network & Security Team
Editor
REXE Teknoloji Technical Editorial
First published
Last updated

Introduction

Packet capture (PCAP) is the process of recording network traffic. It's used to analyze network issues, connection problems, and attack traffic.

PCAP files contain raw network traffic records. They can be opened and analyzed with tools like Wireshark.

Linux Packet Capture (tcpdump)

Installation

hljs bash
sudo apt-get install tcpdump    # Debian/Ubuntu
sudo yum install tcpdump        # CentOS/RHEL

Basic Usage

hljs bash
# Capture on all interfaces, specific port
sudo tcpdump --interface any -w capture.pcap -nn port 25565

# Capture from specific IP
sudo tcpdump --interface any -w capture.pcap -nn host 1.2.3.4

# Limited packet count
sudo tcpdump --interface any -w capture.pcap -nn -c 1000 port 25565

Stop capture with CTRL+C.

Adjust capture duration to the time window when the issue occurs. Usually 1-5 minutes is sufficient.

Windows Packet Capture (Wireshark)

  1. Download from wireshark.org
  2. Open Wireshark as administrator
  3. Select the active network interface
  4. Capture starts automatically
  5. File → Save As to save as .pcap

Unfiltered capture can create very large files. Use port or IP filters when possible.

Submitting to Support

  1. Complete the capture and save the .pcap file
  2. Create a support ticket at my.rexe.tr
  3. Attach the PCAP file
  4. Include: capture date/time, duration, which service/port, issue description, server IP

Frequently Asked Questions

How do I create a PCAP file?

On Linux use 'sudo tcpdump --interface any -w capture.pcap -nn port PORT_NO', on Windows use Wireshark.

Where should I send the PCAP file?

Create a support ticket at my.rexe.tr and upload the PCAP file as an attachment.

How long should I capture packets?

A 1-5 minute capture is usually sufficient. For intermittent issues, start the capture when the problem occurs and stop it a few seconds after the issue resolves.

Related Articles

SSH Connection Problem: Can't Connect to Server

SSH connection troubleshooting guide: Path.net firewall rules, Default Block, creating a filter rule for SSH port, and step-by-step troubleshooting.

8 min
sshconnection problemtroubleshooting
Network TrafficInbound— GbpsOutbound— Gbps