How to Capture Network Packets Using Wireshark

Sometimes Zyxel Support needs a packet capture to find the cause of a network problem.

Wireshark is a free network protocol analyzer that can capture network traffic and save it to a .pcapng file. This file can be shared with Zyxel Support for troubleshooting.

This article explains how to capture packets using Wireshark.

Before You Start

Before you begin, make sure that:

• Wireshark is installed on your computer.
• You know which network adapter is connected to the network.
• You have enough free disk space to save the capture file.

Note: Start the packet capture before you reproduce the issue. This helps capture the complete communication.

Step 1 – Open Wireshark

Open Wireshark.

The main window shows all available network adapters.

Select the adapter that is connected to the network where the problem occurs.

Step 2 – Start Packet Capture

Click the Start Capturing Packets button (blue shark fin).

Wireshark will immediately begin capturing network traffic.

Step 3 – Reproduce the Issue

While Wireshark is running:

• Perform the action that causes the problem.
• Wait until the issue appears.
• Continue capturing for another 10–20 seconds.

This allows Zyxel Support to analyze the traffic before, during, and after the issue.

Step 4 – Stop Packet Capture

Click the Stop Capturing Packets button (red square).

Step 5 – Save the Capture File

Go to:

File → Save As

Save the file in the default .pcapng format.

Example:

Useful Display Filters

Display filters help you find specific packets after the capture is finished.

• ip.addr == 192.168.168.48

Capture Filters (Optional)

Capture filters reduce the amount of traffic before the capture starts.

Examples:

Capture one host:

host 192.168.168.48

Capture one port:

port 443

Capture DNS traffic:

port 53

Important: Capture Filters are different from Display Filters. Capture Filters work before the capture starts, while Display Filters work after the capture is completed.

Best Practices

For the best troubleshooting results:

• Start the capture before reproducing the issue.
• Stop the capture 10–20 seconds after the issue occurs.
• Save the complete capture file.
• Do not remove packets from the file.
• Save the file as .pcapng.
• If possible, note the exact time when the issue occurred.