How to make a network dump (pcap)

A network dump (packet capture, .pcap) records every packet your computer sends and receives. When connection issues are hard to diagnose, support can read the dump and pinpoint exactly what went wrong on the wire — drops, retransmissions, RSTs, slow handshakes, MTU mismatches, …

Pick the instructions for your operating system below.

Option 1 — Windows (Wireshark)

1. Download and install Wireshark.
2. Open Wireshark and select your active network connection (e.g. Wi-Fi or Ethernet) — but do not start it yet.
3. Filter by IP (optional, recommended): if support asked you to capture traffic for a specific server, it's much cleaner to filter to it.
   • Locate the "Capture filter" bar above the interface list.
   • Type: host 85.239.155.123 — replace with the required IP.
   • The bar turns green when the syntax is correct.
4. Double-click your network connection (or click the blue Shark Fin icon) to start.
5. Important: go back to your application or browser and reproduce the error while Wireshark is recording.
6. Return to Wireshark and click the red Square icon (Stop) in the top-left.
7. Go to File → Save As… and save the file as a .pcap (e.g. issue.pcap).
8. Attach the .pcap to your support ticket.

Without the IP filter you'll capture every packet on the interface — fast-growing file, harder to read, and may leak unrelated traffic. Always filter when you can.

Option 2 — Linux (tcpdump)

1. Open a terminal.
2. Run one of the following commands. Both require sudo/root.

   Capture everything (no filter):

   sudo tcpdump -i any -w capture.pcap

   Capture a specific server only (recommended):

   Replace 1.2.3.4 with the server IP:

   sudo tcpdump -i any host 1.2.3.4 -w capture.pcap

3. Important: go back to your application or browser and reproduce the error while the command is running.
4. Return to the terminal and press Ctrl + C to stop the recording.
5. The file capture.pcap is now saved in the current directory. Attach it to your support ticket.

If tcpdump isn't installed:

• Debian / Ubuntu: sudo apt install tcpdump
• RHEL / Fedora: sudo dnf install tcpdump

Option 3 — macOS

macOS works with both approaches above:

• GUI: install Wireshark for macOS and follow the Windows steps.
• Terminal: tcpdump is pre-installed — follow the Linux steps. You don't need to install anything.

Tips

• Reproduce the error during capture. A capture that doesn't contain the problem is useless. Start the capture, then trigger the issue, then stop.
• Keep it short. 30 seconds to a few minutes is usually enough. Big files (>50 MB) take longer to upload and analyze.
• Filter when possible. Capturing only host <server-ip> keeps the file small and avoids leaking unrelated traffic.
• .pcap files can contain sensitive data (TLS handshakes, cookies, headers from other apps). Send them only through your support ticket, not public chat.

With a clear, focused network dump, our team can diagnose the problem far faster and get you back to a stable connection.