Collecting a Wireshark Packet Capture for Support
search cancel

Collecting a Wireshark Packet Capture for Support

book

Article ID: 286824

calendar_today

Updated On:

Products

Carbon Black App Control Carbon Black Cloud Endpoint Standard Carbon Black Cloud Enterprise EDR Carbon Black EDR CBX Complete CBX Essentials Mobility Threat Protection Cloud Secure Web Gateway - Cloud SWG Cloud SWG Express Web Isolation for Cloud SWG IT Management Suite Ghost Solution Suite Deployment Solution Client Management Suite Endpoint Protection Endpoint Security Endpoint Security Complete Data Center Security Server Data Center Security Server Advanced

Issue/Introduction

This article provides some guidance on capturing a network packet trace using Wireshark

Important Note: Wireshark is a product of the Wireshark Foundation company. Broadcom does not own or manage these products or web sites, nor can Broadcom Technical Support assist you in using Wireshark. You are advised to contact Wireshark Foundation directly for assistance in basic usage of their product. References here to Wireshark and third-party web sites are provided "AS IS".

Environment

  • Wireshark: All Supported Versions
  • Microsoft Windows: All Supported Versions

Resolution

Step 1: Preparation and Installation

  • Download Wireshark from wireshark.org. During installation, ensure that the necessary packet capture drivers (Npcap for newer versions, or WinPcap for older versions) are installed to record live traffic.
  • If you are using a Windows environment with User Access Control (UAC) enabled, right-click the Wireshark shortcut or executable and choose "Run as administrator". In Linux/Unix, run wireshark from a root shell in a terminal emulator.

Step 2: Configuration

  1. Navigate to Edit > Preferences > Protocols > HTTP.
  2. Add any required custom ports to the SSL/TLS Ports list (e.g., if troubleshooting Carbon Black App Control, enter 443, 41002).
  3. Click OK.
  4. Navigate to Capture > Options (or Interfaces).
    • Input Tab:
      • Highlight the correct interface(s) on which packets need to be captured.
      • Confirm Promiscuous Mode is enabled, so adapter captures all traffic, not just traffic destined for your workstation.
    • Filters: Leave filters blank. Support usually prefers an unfiltered trace.
    • Options Tab:
      • Packet Limits: Leave options like "Limit each packet to..." unset. Support needs to see full frames.
      • Stop Conditions: Leave "Stop capture after X packets/kilobytes/seconds" disabled.
      • Name Resolutions: Leave MAC name resolution enabled. Leave network (DNS) and transport name resolutions disabled.

Optional - Setting up "Rolling Captures" (For Intermittent Issues only)

If the issue you are trying to catch occurs intermittently or takes a long time to recreate, configure a "Rolling Capture":

  1. Navigate to Capture > Options, select the Output tab.
  2. Check the "Create a new file automatically after..." box.
  3. Define the interval by time, file size, or a certain number of packets (e.g., create a new file every 50 MB).
  4. Specify a base file name for reliability. Wireshark will wrap to the next file once the limit is hit, saving your captures in manageable chunks without crashing your system.

Step 3: Executing the Capture

  1. Click Start to begin capturing. You should see the number of packets increasing in real-time.
  2. Reproduce the issue. Perform the exact steps that trigger the network problem. Collect roughly 5 to 10 minutes of network activity while recreating it.
    • Note on Rolling Captures: If using rolling captures, allow about 1 minute to pass after you observe the issue to ensure the event is fully recorded before stopping.
  3. Click Capture > Stop.

Saving and Formatting the Data for Support

Once you have captured the event, package the data properly to send to the support engineer:

  1. Save the File: Go to File > Save As. Save the capture in a supported format like .pcap or .pcapng (e.g., {devicename}.pcapng).
  2. Compress the file using a Zip utility.
    • Note on Rolling Captures: Only upload the specific file(s) that contain the timeframe of the reproduced error. Do not upload all the files generated by the ring buffer.
  3. Provide Context (trace_info.txt): A packet capture is much easier to analyze when accompanied by context. Create a trace_info.txt file to include in your Zip archive containing:
    • A description of the problem (When did it start? Steps to reproduce).
    • IP and MAC addresses of the machines involved, plus names of the servers/files accessed.
    • The approximate time or packet number where the error occurred (e.g., "Packets 1-30 are boot. The error occurred at approximately packet 1,480").
    • Workstation OS, network configuration, routers involved, and client software version (including any active patches).
  4. If applicable, provide a "working" trace alongside the "non-working" trace for comparison.

Additional Information

Powered by Wolken Software