---
title: "Perform a Packet Capture/TCP Dump"
slug: "perform-a-packet-capturetcp-dump"
description: "This article describes performing a packet capture/TCP dump for both Linux-based and Windows-based systems. "
updated: 2025-10-23T21:03:56Z
published: 2025-10-23T21:03:56Z
canonical: "support.bcmone.com/perform-a-packet-capturetcp-dump"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.bcmone.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Perform a Packet Capture/TCP Dump

Have you ever wanted to check out your SIP signaling? Want to try and do some personal troubleshooting? Or do you have an open ticket that requires a PCAP (packet capture)? No matter the situation, the following article describes easy steps you can follow to get your PCAP.

### SIP Ports

- The default port for SIP signaling (UDP or TCP) is port **5060**; port 5160 can be used as an alternative port for SIP signaling.
- Port **5061** (TCP) is used for **TLS** communications. If you are using TLS, our **Support Team will be unable to decrypt your packet capture**.

### For Linux-based Systems

1. Start a trace by running the following command:

```c
tcpdump -s 3000 -w ~/flowroute-{{case.id}}.pcap port 5060 or portrange 10000-35000 
tcpdump -s 3000 -w ~/flowroute-{{ticket.requester.first_name | downcase}}.pcap port 5060 or portrange 10000-35000.
```

> [!NOTE]
> **NOTE:** If you don't have tcpdump, it should be available through your distribution's package manager or from [http://www.tcpdump.org/](http://www.tcpdump.org/).
2. Place a test call to reproduce the problem you're experiencing.
3. Close the trace by pressing **CTRL+C**.
4. Compress and attach the resulting file, *flowroute-{{case.id}}.pcap*, to the ticket so that we can analyze the file to diagnose the issue. This file will be located in your home or **~/** directory.
5. Compress and attach the resulting file, *flowroute-{{ticket.requester.first_name | downcase}}.pcap*, to the ticket so that we can analyze the file to diagnose the issue. This file will be located in your home or **~/** directory.

### For Windows-based Systems

1. Download and install a network capture tool, such as [Wireshark](https://www.wireshark.org/).
2. Click the **Capture** menu, and then click **Interface**.
3. Select the network interface on which the traffic is being sent and received, and then click **Start**.
4. Place a test call to reproduce the problem you're experiencing.
5. Click the **Stop Capture** icon on the menu.
6. Click **File**, and then click **Save As** and save the file as *flowroute-{{ticket.id}}.pcap*.
7. Compress and attach the resulting file, *flowroute-{{ticket.id}}.pcap*, to the ticket so that we can analyze the file to diagnose the issue.
8. Click **File**, and then click **Save As** and save the file as *flowroute-{{ticket.requester.first_name | downcase}}.pcap*.
9. Compress and attach the resulting file, *flowroute-{{ticket.requester.first_name | downcase}}.pcap*, to the ticket so that we can analyze the file to diagnose the issue.

### Submit Your Request to Support

In order to achieve faster and more accurate support response please follow our best practices while submitting your request:

- **Authorization:** Supply your account Auth information so that Support can easily locate your account:
  - *Email address* on your Flowroute Account
  - *Tech Prefix* (an 8-digit number that can be located on your [Dashboard](https://manage.flowroute.com/accounts/profile/))
- **Call Examples:** When submitting an issue with calls, always provide us with a call example. A good call example must:
  - *Be less than 24 hours old:* most of our carriers only store logs for 24 hours and it's critical to have a fresh call example when the issue requires escalation to external peers.
  - Contain *FROM* and *TO* numbers, *TIMESTAMP* along with *TIMEZONE*, *CALL-ID* (you can find "sip_callid" value in [CDR Report](/flowroute-support/docs/call-detail-record-cdr-reports)), the detailed *DESCRIPTION* of the issue (one-way-audio/dead-air/fast-busy/etc., error-code/message), and any other information you believe can help us to investigate this issue.

## Related

- [SIP Response Codes](/sip-response-codes.md)
- [Reviewing Your Connected PoPs](/reviewing-your-connected-pops.md)