Capturing Telephony Traffic With Wireshark

Generate Packet Capture using WireShark

WireShark is a freely available and commonly used tool to generate a Packet Capture (PCAP) file. PCAP files contain a snapshot of all network data visible on a Network Interface without modifying or altering the data in any way.

Go to https://www.wireshark.org/ to download and install the version of WireShark relevant to your operating system. This guide assumes installation on Microsoft Windows, and therefore all screenshots in this guide will show that environment. However, the interface is consistent across other environments such as MacOS with a slight variation in look and feel.

When you first open WireShark, you should see an interface like the following. Please note that you may need to run it as an Administrator, or the tool may prompt you to elevate your permissions to Administrator when you modify certain settings or start a packet capture.

In the main menu, choose “Capture -> Options”.

You will then be presented with the following dialog:

Ensure that the “Enabled promiscuous mode on all interfaces” option has been checked, and click “Close”.

Next, start a fresh packet capture by clicking the blue “shark fin” icon in the toolbar:

Once you have started the capture, you should see data begin to fill the main window. This can take several seconds to start depending on your machine.

Allow the capture to run for 15 to 20 minutes, during which you should make several test calls on your call system.

Wait an additional 2 - 3 minutes in order to ensure that all call data for the test calls has been incorporated into the capture before stopping it.

To stop the capture, just click the “red square” in the tool bar:

The final step is to save the capture file using the “File -> Save as” in the main menu:

Choose a name for the file like: “2025-08-16-<NAME OF CENTER>.pcapng

Keep note of where the file was saved, and make arrangements to send it to your contact in GovWorx Technical Services.