How to Perform a Packet Capture on a Peplink Device – Llama Networks

When you're troubleshooting a tricky network issue such as dropped VoIP calls, an application that won't connect, unexplained latency, or traffic that doesn't route the way you expect, a packet capture is often the fastest way to see what's actually happening on the wire. Every Peplink router includes a built-in capture tool on a hidden support page called support.cgi. This article walks you through using it and sharing the results with our support team.

What is support.cgi?

support.cgi is a hidden diagnostics page built into the Peplink web admin interface. It isn't linked from the normal dashboard menus; you reach it by editing the URL directly. Along with several other diagnostic tools, it contains the Network Capture utility, which records raw network traffic on the router's interfaces and packages it as .pcap files you can open in Wireshark or attach to a support ticket.

Note: The tools on this page are intended for troubleshooting. Don't change settings you aren't familiar with, as some options on support.cgi can affect live traffic.

Before you begin

You need admin credentials for the router's web interface. You can get these through InControl2 as well.
You need a way to reach the router's admin page: a computer on the LAN, or remote access through InControl2 (see Step 1).
If you plan to analyze the capture yourself, install Wireshark (free). Otherwise you can simply download the file and attach it to your ticket.
Know how to reproduce the problem. A capture is most useful when the issue actually occurs while the capture is running.

Step 1: Log in to the router's web admin

Open a browser and go to your router's admin address. On most Peplink MAX/BR1 routers this is 192.168.50.1 (over HTTPS), or use the LAN IP configured for your device.
Log in with your admin username and password.

Not on site? If the device has an active InControl2 subscription and you have access to it in your InControl2 organization, you can reach the web admin remotely: log in to InControl2, open the device's details page, and use the Remote Web Admin link. This tunnels you into the router's admin interface through the cloud, with no VPN or port forwarding required. From there, the rest of this guide works exactly the same.

Step 2: Open the support.cgi page

Once logged in, look at the URL in your address bar. It will end in index.cgi (the path is /cgi-bin/MANGA/index.cgi).
Replace index.cgi with support.cgi, so the address ends in:
/cgi-bin/MANGA/support.cgi
Press Enter. The support page loads as a plain list of diagnostic tools.

Step 3: Start the capture

Scroll down the page to the Network Capture section and click "Click to Show"
For the Connection dropdown, select the interface you want to capture
Click Start. The router begins recording traffic on its interfaces (WAN, LAN, cellular, VPN, etc.).

Tip: The capture is unfiltered (it records everything crossing the router) and the capture buffer is limited. Start the capture immediately before you reproduce the problem, and keep the window as short as possible, ideally under a minute or two, so the traffic you care about isn't buried or rotated out.

Step 4: Reproduce the issue

While the capture is running, trigger the problem: place the failing call, load the failing website, run the speed test, or wait for the symptom to occur. Make a note of the exact time and the IP addresses or applications involved; this makes analysis much faster.

Step 5: Stop and download

Return to the support.cgi page and click Stop in the Network Capture section.
Click Download. Your browser saves a compressed archive (.tar.gz) containing separate .pcap capture files for each of the router's interfaces.

To extract the archive: macOS and Linux open .tar.gz natively; on Windows, use a tool such as 7-Zip. Each .pcap file inside is named for its interface, so you can open just the WAN or LAN capture you need in Wireshark.

Step 6: Send the capture

Attach the downloaded archive to your support ticket along with:

The approximate time you reproduced the issue (with timezone)
The source/destination IPs, domains names, or application involved
A short description of what you did and what you observed

If the file is too large to attach, let us know and we'll provide an upload link.

Alternative: Remote capture with Wireshark

On firmware 6.3 and later, the Network Capture section also offers a Remote Capture option. Instead of saving to a file on the router, this streams packets live to an external machine, where you can watch them in real time in Wireshark. Tick the Remote Capture checkbox, enter the IP address and port of the receiving computer, and start the capture. This is handy for long-running or intermittent issues where a short buffered capture isn't enough.

Troubleshooting

The support.cgi page won't load: Confirm you're logged in to the web admin in the same browser tab/session, and that you kept the /cgi-bin/MANGA/ portion of the URL intact.
The download is empty or missing traffic: The buffer may have wrapped. Re-run the capture with a shorter window, starting it right before reproducing the issue.
You can't reach the router at all: A capture won't help if the admin page is unreachable. Contact us and we'll capture from our side or via InControl2.

As always, if you'd rather we drive: open a ticket and our team can walk you through the capture live or pull diagnostics remotely.