How to Capture a PCAP with Wireshark (Windows)

A short guide to recording network traffic while joining a game, then saving it as a .pcap file.

Screenshots below are from Wireshark 4.6 on Windows. Some dialogs show Dutch labels (Bestandsnaam = File name, Opslaan = Save, Annuleren = Cancel); English equivalents are given alongside.

1. Install Wireshark

1. Download the Windows installer from https://www.wireshark.org/download.html
2. Run the installer. When it asks, make sure "Npcap" is checked — Wireshark cannot capture anything without it.
3. In the Npcap sub-installer, leave the defaults.
4. Reboot if the installer asks you to.

2. Prep before you record

Do this so your capture is small and easy to read:

• Close anything noisy: browsers, Spotify, Steam downloads, cloud backups, Discord if you don't need it.
• Have the game already launched and sitting at the main menu. You only want to record the act of joining.
• Know which network adapter you actually use — Wi-Fi or Ethernet.

3. Pick the right interface

Open Wireshark. The start screen lists your adapters under Capture:

Each adapter has a small live sparkline next to it. The adapter with the moving line is your active connection — that's the one you want. In the screenshot above, Ethernet is the live wired connection.

If you're unsure, open Command Prompt and run ipconfig; the adapter showing an IPv4 address is the live one.

Ignore "Adapter for loopback traffic capture", VPN adapters (OpenVPN TAP, Tailscale) and vEthernet (WSL) unless you specifically need that traffic.

4. Start recording

Double-click the active adapter, or select it and click the blue shark-fin button at the far left of the toolbar:

Packets start scrolling immediately. That's it — you're recording. The title bar changes to "Capturing from Ethernet":

5. Join the game

1. Leave Wireshark running in the background (don't close it, don't stop the capture).
2. Switch to the game and join the server / lobby / match as you normally would.
3. Wait until you're fully loaded in and have been in-game for 10–30 seconds.

Keep this window short. A 30-second capture is far easier to analyze than a 20-minute one.

6. Stop recording

Alt-Tab back to Wireshark and click the red square Stop button in the toolbar (second icon), or press Ctrl + E:

The packet list freezes and the title bar loses the "Capturing from…" text.

7. Save the file

Go to File → Save As… (or press Ctrl + Shift + S):

1. Pick a folder you'll remember — Desktop or Downloads.
2. In File name (Bestandsnaam), type something descriptive, e.g. game-join-2026-07-28.
3. In the Save as dropdown, choose your format:

4. Leave Compression options on Uncompressed.
5. Click Save (Opslaan).

If someone specifically asked for a .pcap, pick the pcap entry, not pcapng. They are not the same format and some tools only read .pcap.

8. Quick sanity check

Reopen the saved file (File → Open) and confirm:

• Packets are present (not an empty list).
• The timestamps cover the moment you joined.
• You can see UDP or TCP traffic to an external IP address.

If the capture is empty, the usual causes are: Npcap wasn't installed, you picked the wrong adapter, or Wireshark needs elevation (right-click → Run as administrator).

Useful extras

Filter while capturing (optional, keeps the file tiny). Type into the capture filter box on the start screen before hitting record:

udp

or, to exclude your own web browsing:

not port 80 and not port 443

Filter after capturing — type in the display filter bar at the top:

Shrink a large capture before sharing: apply a display filter, then File → Export Specified Packets… → All packets (Displayed).

Privacy note

A pcap contains everything your machine sent and received during that window — including your public IP, DNS lookups, and potentially unencrypted traffic from other apps. Close unrelated programs before recording, and only share captures with people you trust.

Updated on: 28/07/2026