Use Wireshark to Perform a Packet Capture of Network Traffic for Salesforce Support

This article explains how to capture network traffic using Wireshark and provide the resulting packet capture (.pcap) file to Salesforce Support for network-related troubleshooting. Wireshark is a free, open-source packet analyzer that records network traffic between your machine and Salesforce for analysis.
You will need administrator rights on your local machine to complete these steps. If you are unsure, contact your IT administrator before proceeding.

How to Provide Network Capture Logs to Salesforce Support

To investigate network-related issues, Salesforce Support may ask you to capture network traffic using Wireshark. Wireshark allows packet traces to be monitored, captured, and analyzed. Follow the steps below to obtain a capture of your network traffic.

Installing the Wireshark Package

Visit the Wireshark download site and download the appropriate package or installer for your operating system.
When installing, ensure all components are selected for installation, including the optional WinPcap application (Windows only).
Once installation is complete, start Wireshark via its shortcut or the Start menu.

Capturing Your Traffic with Wireshark

After starting Wireshark:

1. Select Capture | Interfaces.
2. Select the interface on which packets need to be captured. This is usually the interface where the Packets/s column is constantly changing, indicating live traffic. If you have multiple network interface cards (LAN and Wi-Fi), check with your IT administrator to determine the correct interface.
3. Click Start to begin the capture.
4. Reproduce the problem. The capture dialog shows the number of packets increasing. Avoid running other internet applications while capturing — close other browsers, instant messengers, and similar tools.
5. Once the issue has been reproduced, click Stop. It may take a few seconds for Wireshark to display the captured packets.
6. Save the packet trace. Click File > Save As. Wireshark saves the trace in libpcap format with a .pcap file extension by default.