How to Create a PCAP File on Your VPS

A PCAP file (Packet Capture) records all network traffic on your server. In some cases, our support team needs this data for an in-depth analysis of network issues – e.g. DDoS attacks, connection drops, or packet loss.

Prerequisites

• VPS with SSH or Remote Desktop access
• tcpdump installed (Linux) or Wireshark installed (Windows)

Linux – tcpdump

Installing tcpdump

sudo apt install tcpdump        # Debian/Ubuntu
sudo yum install tcpdump        # CentOS/RHEL
sudo pacman -S tcpdump          # Arch Linux

Find Your Network Interface

Before starting a capture, you need to know which network interface your server uses:

sudo tcpdump -D

Common interface names are eth0, ens18, or ens192.

Start the Capture on Linux

Capture all traffic (100,000 packets):

sudo tcpdump -ni eth0 -s 0 -c 100000 -w capture.pcap

Capture only a specific port:

sudo tcpdump -ni eth0 -s 0 -c 100000 -w capture.pcap port 25565

Capture only traffic from/to a specific IP:

sudo tcpdump -ni eth0 -s 0 -c 100000 -w capture.pcap host 123.45.67.89

Combine port and IP:

sudo tcpdump -ni eth0 -s 0 -c 100000 -w capture.pcap host 123.45.67.89 and port 25565

Exclude your own SSH connection (recommended to prevent your session from skewing the capture):

sudo tcpdump -ni eth0 -s 0 -c 100000 -w capture.pcap not port 22

Important Parameters Explained

Windows – Wireshark (tshark)

Installing Wireshark

Download Wireshark and install it. The command-line tool tshark is automatically installed alongside it.

List Available Interfaces

"C:\Program Files\Wireshark\tshark.exe" -D

Start the Capture on Windows

Capture all traffic:

"C:\Program Files\Wireshark\tshark.exe" -i 1 -c 100000 -w C:\capture.pcap

Capture only a specific port:

"C:\Program Files\Wireshark\tshark.exe" -i 1 -f "port 25565" -c 100000 -w C:\capture.pcap

Capture only traffic from/to a specific IP:

"C:\Program Files\Wireshark\tshark.exe" -i 1 -f "host 123.45.67.89" -c 100000 -w C:\capture.pcap

Compress the File

PCAP files can become very large. Compress the file before sending:

Linux:

gzip capture.pcap

Windows (PowerShell):

Compress-Archive -Path C:\capture.pcap -DestinationPath C:\capture.zip

Send the Result to Support

Include the following information in your support ticket:

1. The PCAP file compressed as .gz or .zip
2. Date and time of the capture
3. Filter used – which port or IP you filtered
4. Brief problem description – e.g. DDoS attack, connection drops, lag spikes
5. Affected service – which service on which port is affected