Packet capture to a pcap file on a USB drive

How to capture ethernet packets with your netool to a pcap file saved on a USB drive.

More info about pcap files at Wikipedia.

Prerequisites:

Firmware build 56 and above.
iOS or Android app 1.7.0 and above.
Windows or macOS app 1.1.0 or above.

Step 1: Plug the ethernet into your Netool’s ethernet port.

Step 2: Now tap on the settings icon.

Step 3: Then tap on “Netool Mode”.

Step 4: Turn on the toggle switch for “Capture to PCAP (USB)” and tap on “Apply” to switch your your netool into Capture to pcap mode. The Netool will now reboot.

Step 5: Re-connect to your Netool’s wifi AP. Then open up the Netool.io app and you will be presented with the PCAP capture screen.

Step 6: Plug a Fat32 formatted USB drive into the USB type-a port located on the back of your netool.

Step 7: Once the netool automatically mounts the USB drive, this can take longer with some thumb drives, the USB icon on the main pcap capture screen will turn blue, the “USB Drive Freespace” field will update with the amount of free space on the inserted USB drive and the start button will appear. To start packet capture tap the start button, there will be a short delay before the packet capture process starts.

Step 8: When packet capture starts, a new pcap file named with the date and time will appear in the “USB File Name” field and the “USB File Size” will start to increase. When you reached the amount of packets you would like to capture you can stop the capture process by tapping on the stop button.

Step 9 (optional): Set a capture timeout. You can set the amount of time a packet capture will run by tapping on the pencil icon on the capture main screen or by going to the settings menu, then discovery timers menu.

Step 10 (optional): The capture time will be indicated in the “Capture Timeout” field.

Step 11: You can now unplug your your USB drive from your netool and plug it into a computer. Once plugged into your computer you can open up the pcap file in wireshark, upload it to cloudshark.com or analyze it in any tool that opens a pcap file.