PacketSafari
Log in

How to capture packets

Capture with your preferred tooling, then upload the PCAP to PacketSafari.

PacketSafari Analyzer does not record traffic in your browser. Capture on the device or tap that sees the traffic, save a .pcap or .pcapng, and upload it to the analyzer. Our capture guides list playbooks for common scenarios.

Deployments with the optional PacketSafari endpoint sensor can instead select an enrolled device, inspect its bounded application/connection inventory, run an authorized capture, and receive an evidence receipt. Platform support is not uniform: review the endpoint capture and decryption feature map for qualified capture, process attribution, key collection, and verification paths.

Recommended capture tools

  • Dumpcap (cross-platform). Ships with Wireshark; low overhead CLI that is ideal for long captures and ring buffers.
  • tcpdump (cross-platform). Ubiquitous command-line capture with BPF filters for quick, targeted traces.
  • Wireshark (cross-platform). Friendly UI for on-the-spot captures and protocol validation.
  • Packet Monitor / pktmon (Windows). Built-in Windows capture tool: Microsoft pktmon guide

Capture tips

  • Prefer .pcapng for richer metadata (comments, interface info, TLS keys).
  • Capture the full handshake when you plan to decrypt TLS (enable SSLKEYLOGFILE on the client).
  • If sensitive payloads are present, capture with slicing or anonymize before uploading (see the next section).
  • Keep notes on where the tap was placed; the capture point visualization relies on TTL and RTT hints to infer the path.

The endpoint sensor applies capture filters on the device and can retain large captures in a bounded local spool. Compact process, protocol, flow, and live packet summaries reduce control-plane traffic; full packet delivery and later segment download remain explicit operator actions.