Help Center/ Elastic Cloud Server/ Best Practices/ Maintaining and Monitoring ECSs/ Using Packet Capture Tools to Capture Network Data Packets
Updated on 2026-07-29 GMT+08:00
View PDF
Share

Using Packet Capture Tools to Capture Network Data Packets

Scenarios

When your ECS experiences increased latency, disconnections, or packet loss during access to the target end, capturing raw network packets at the interface is essential for reproducing the issue and locating the root cause.

This section describes the standard process and practical tips for using the tcpdump and Wireshark tools to capture packets on Linux and Windows ECSs, respectively.

Process

A systematic network troubleshooting process usually consists of the following six phases. The objectives and outputs of each phase must be clearly defined to ensure efficient fault locating.

No.

Phase

Core Task

Key Output

1

Symptom definition

Use tools such as ping and traceroute to determine the exception type:

  • Continuous packet loss
  • High latency during peak hours
  • No response from a specific port (such as port 80 or 443)

Identify the target IP address, port, and time pattern of the exception.

2

Tool selection

Select a tool based on the OS:

  • Linux ECSs: the command line tool tcpdump is preferred.
  • Windows ECSs: the graphical tool Wireshark is recommended.

Select a packet capture tool that matches the system and scenario.

3

Preset filtering

Configure packet capture filtering rules, such as specifying the host, port, or protocol, to avoid capturing a large amount of irrelevant data that may mask key clues.

Generate precise packet capture filtering expressions.

4

Data capture

Start packet capture when the fault occurs, and clearly record the start and end time, network interface, destination port, network protocol, and packet size.

Obtain the network data packet file (such as .cap or .pcap) that contains the exception.

5

In-depth analysis

Analyze data packets using the following common methods:

  • Check the TCP handshake process.
  • Search for retransmitted packets.
  • Analyze the response time.
  • Check error codes.

Locate the specific abnormal data packet or interaction patterns.

6

Verification and closure

If the analysis result does not provide a clear root cause, you can use other tools or methods to further locate the fault.

  • Use commands such as ping and traceroute to check the network connectivity, packet loss, and latency.
  • Verify the cause of the fault based on the routing table, security group logs, or system logs.

Create a closed-loop record following the "hypothesis-verification-resolution" cycle.

Using tcpdump to Capture Packets on Linux ECSs

tcpdump is a powerful command line tool for packet capture built into Linux. It has been pre-installed in almost all Huawei Cloud public images (such as CentOS and Ubuntu).

If it is not installed due to the minimal installation, you can use the package manager to install it by running the sudo yum install tcpdump -y or sudo apt-get install tcpdump -y command.

View the instructions for using tcpdump. 
tcpdump --help

For more information about the tcpdump parameters and usage, see TCPDUMP MAN PAGE.

Common scenarios for using tcpdump are as follows.

  • Scenario 1: Capture packets on a specified interface and port. 
    tcpdump -s 0 -i eth0 port 22

  • Scenario 2: Capture packets on a specified interface and port, and generate detailed interaction information. 
    tcpdump -s 0 -i eth0 -vvv port 22

  • Scenario 3: Capture packets of a specific protocol on a specified interface and IP address. 
    tcpdump -s 0 -i eth0 -vvv dst 123.xxx.xxx.74 and icmp

  • Scenario 4: Capture packets and save them to a specified file. 
    tcpdump -i any -s 0 -w test.cap

  • Scenario 5: View the content of the generated packet capture file. 
    tcpdump -r test.cap

Using Wireshark to Capture Packets on Windows ECSs

Wireshark is the preferred graphical packet capture tool for Windows ECSs.

  1. Log in to the Windows ECS.
  2. Download and install Wireshark from Wireshark and then start it.
  3. Choose Capture > Options. In the capture window, select the network for which you want to capture packets based on the interface name or IP address, and click Start.
  4. After capturing sufficient data packets, choose Capture > Stop. Then, choose File > Save As to save the captured packets to a specified file.
  5. Choose Statistics > Conversations from the toolbar.
  6. In the conversations window, view all network communications, which provide detailed traffic metrics and endpoints across the link, IP, and TCP layers.
  7. Analyze which connections and ports are consuming high traffic based on the captured network packets.

    For more information about how to use Wireshark and analyze data, visit the Wireshark official website.