Recording traffic for support
Capture Traffic prepares a short, bounded packet capture of one host for a support case: what it records, its limits, and how to run it in Terminal.
Sometimes a problem needs a recording of the traffic itself, not just the list of connections. Capture Traffic prepares a short packet capture of the traffic to one host, with fixed limits, and gives you the exact command to run. Outbound runs nothing from the sheet.
Preparing a capture
Section titled “Preparing a capture”In the Network Monitor, right-click a destination and choose Capture Traffic to followed by the host name. A sheet opens with a warning first: “Packet captures may contain private payloads, passwords and personal data. Share captures only with someone you trust.”
The sheet has these fields:
- Host: the destination you right-clicked. You can change it.
- Port (optional): the destination’s port, if it has one.
- Network interface:
en0unless you change it. - Duration: 1 to 600 seconds. It starts at 60.
- Size limit: 1 to 500 MB. It starts at 50.
- Output file: where the recording is saved,
Outbound Capture.pcapngon your Desktop by default.
“Capture is limited to this host and optional port. It does not identify traffic by app.” The recording holds everything this Mac exchanged with that host while it ran, whichever app sent it.
Running it
Section titled “Running it”Below the fields, the sheet shows the command to run, with Copy Command. It runs outboundctl capture with your choices through sudo, so you paste it into Terminal and approve it with an administrator’s password. “Nothing runs from this sheet. Paste the command into Terminal and approve it as an administrator.”
Open Exact tcpdump command to see the tcpdump command that outboundctl runs for you, with the same host, port, interface, time and size limits. The capture stops at whichever limit it reaches first, and the result is a pcapng file.
From Terminal
Section titled “From Terminal”outboundctl capture takes the same choices: --host, --port, --interface, --duration (seconds), --max-mb and --out. Without --run it only shows the command it would run, and changes nothing. --run starts the capture and needs root, so run it with sudo.
Sending it
Section titled “Sending it”A capture can contain the contents of unencrypted traffic, and names and addresses even when the traffic is encrypted. Send it only to someone you trust, such as Outbound support when they ask for one. To start a support case, see Report a problem.