Wireshark Helper

⚠️ Quick analysis tool - always verify results. This tool analyses raw packet data heuristically to help you quickly identify potential issues and likely causes. It is not a substitute for full protocol analysis in Wireshark. Findings are based on traffic patterns and thresholds - they may not apply in every network environment. Always confirm results before making changes to a live system, and take a backup first where applicable.

Drop your PCAP here

or click to browse

.pcap .pcapng .cap

389 packets - TCP retransmits, DNS errors, rogue DHCP, Kerberos skew, TLS 1.0 and more

Capture Method

🔀

Port Mirror

DrayTek, Netgear, HP, UniFi, D-Link

🔷

UniFi

SSH + tcpdump

🛡️

WatchGuard

Fireware SSH + WSM

Capture Options

Snap length (bytes)

Capture mode

Packet count (0=unlimited)

Duration secs (0=unlimited)

File naming

Filename prefix

Include in filename

Date and time stamp Device hostname

Capture destination

Remote temp path

Local save path

Port Mirror Setup

Device

Web UI Steps

Capture Settings

Your PC network interface

Run tshark -D to list interfaces

Save to folder

File prefix

Rotate every (seconds)

300 = 5 min files

Keep last N files

36 x 5 min = 3 hrs

Capture filter

IP address

Custom BPF filter

BPF syntax - see Filter Reference tab

Snap length

Capture size estimate

Estimated link speed

Estimated utilisation

CMD - run in Command Prompt as Administrator

Scheduled start

Start capture

Generated Script

Select a method and configure settings
to generate your capture script.

Drop your PCAP here

Customer Report