Saving, rings, and snap length

pcapng remembers more of the context

Save lab captures as pcapng unless a tool you must use only reads the older pcap format. pcapng keeps interface names, comments you attach to frames, and several capture metadata fields that help the next person. A frame comment is a good place for “this is the login,” and the comment travels with the file.

File, then Export Specified Packets, writes a smaller file from the displayed frames, the marked frames, or a range. That is how you hand a reviewer the login and not the entire morning. Export is a copy. Keep the original with the engagement notes until the agreement says to delete it.

A ring buffer for a lab sensor

A long capture on a busy lab link will fill a disk, and a full disk becomes the incident. In the capture options, create a new file automatically after a size or a duration, and enable a ring buffer of a fixed number of files. The oldest file is reused. You choose how much history you can store before you start.

Write the rotation settings in the lab notebook. “Twelve files, 100 MB each, about two hours” is a design. Finding a single full disk in the morning is not. Stop conditions, by duration or by a file count, belong in the same note. This is for an interface you are allowed to record.

Worked case: the login was cut off by the snap length

You capture the lab web login on 10.8.0.20 with a snap length of 96 bytes, because a tutorial recommended keeping captures small. The TCP handshake is complete in the file. The HTTP request is not: the headers start and the POST body is absent. Follow HTTP stream shows a truncated request. The password you expected to confirm was never stored.

Repeat the lab capture with the full frame. The POST body is present, because the snap length no longer stops at the headers. For a long metadata-only capture, a short snap length can be a deliberate choice, and you write it down. For any lab question about contents, capture the whole frame the first time.

http.request.method == "POST" && ip.addr == 10.8.0.20

The file is sensitive the moment it exists

A capture from the lab can still hold a password, a cookie, or a name. Store it with the engagement notes, not in a chat paste and not in a ticket that a wide group can read. Delete it when the agreement says to. A ring buffer on a laptop does not change that duty. It only bounds the disk.

Mark the frames you cite, and comment them, before you export the subset. The reviewer should be able to open the small file and land on the same frames your note names.

• pcapng for comments and interface names.
• Export a subset when the whole file is more than the question.
• Ring the files when the capture runs unattended.
• Full frames when the question is about contents.