Guides
Sharing Packet Captures Safely
Share only the packets and details needed for troubleshooting; capture files can expose payloads and network identifiers.
Which format should you choose?
Choose by the role each file plays in your workflow.
- Capture only the relevant hosts, protocols, and time window
- Export selected packets when it preserves needed context
- Review payloads, addresses, names, tokens, and personal data
- Agree on named access, encryption, and deletion
Limit the capture before export
Narrow the interface, hosts, protocol, and time window. Wireshark can export specified packets, but removing traffic may remove context needed to reproduce a fault.
Inspect payloads and metadata
Check packet bytes and decoded fields for credentials, tokens, message contents, internal addresses, hostnames, and personal data. TLS may hide payloads while endpoints and timing remain visible. A display filter alone does not remove packets from the saved file.
Protect the handoff
Use an approved channel with access limited to named recipients. Agree on encryption and retention; if you anonymize data, verify both that sensitive values are gone and that diagnosis remains possible.
Formats to consider
PCAPNG
Good for: pcapng: Keep interface metadata when recipients support it
Less suitable for: Sharing with a recipient whose tools do not support PCAPNG
PCAP
Good for: pcap: Share selected packets with broad legacy-tool support
Less suitable for: Preserving all PCAPNG comments and multi-interface details
Before you export
- Get authorization and follow privacy and incident-handling rules before collecting or disclosing traffic.
- Converting PCAPNG to PCAP does not anonymize payloads or identifiers.
- Verify recipients, encryption, retention, and sanitized content before transfer.