How to Capture and Read Network Traffic With Wireshark and tcpdump

Step by step

1. Decide where to capture

   Capture as close to the problem as possible: on the affected client, on the server, or on a switch mirror port that copies the traffic of the device you are investigating.

2. Capture on a server with tcpdump

   Limit the capture to the hosts and ports you care about, and write it to a file you can open in Wireshark.

   sudo tcpdump -i eth0 -nn -s 0 host 10.1.10.50 and port 443 -w /tmp/case123.pcap
   # stop with Ctrl+C, then copy the file to your laptop
   

3. Use a ring buffer for intermittent problems

   If the fault happens once an hour, capture continuously into rotating files so the disk never fills.

   sudo tcpdump -i eth0 -nn -w /var/tmp/cap.pcap -C 100 -W 20 host 10.1.10.50
   # 20 files of 100 MB, oldest overwritten
   

4. Filter in Wireshark

   Display filters narrow millions of packets to the few that matter.

   ip.addr == 10.1.10.50
   tcp.port == 443
   dns && dns.flags.rcode != 0          # DNS errors
   dhcp                                  # DHCP (older versions: bootp)
   tcp.analysis.retransmission           # lost/resent segments
   tcp.analysis.zero_window              # receiver overloaded
   tls.alert_message                     # TLS failures
   

5. Follow one conversation

   Right-click a packet > Follow > TCP Stream to see one connection from start to end. Check the handshake: SYN, SYN-ACK, ACK. A SYN with no answer means a firewall or routing problem; a RST means the server refused.

6. Read the timing

   Statistics > Conversations shows bytes and duration per pair. Set View > Time Display Format > Seconds Since Previous Displayed Packet to find long gaps: a slow server answer looks very different from network loss.

7. Share safely

   Trim the capture to the relevant packets (File > Export Specified Packets) before sending it to a vendor. Delete captures when the case is closed.

Commands are generic, industry-standard examples. Exact syntax and menu names vary by model and firmware; check your device's manual on the Documentation page.