Where does GNS3 save packet captures?

The server writes the capture into the project folder, under project-files/captures, named after the two nodes and ports. If the server is remote or runs in the GNS3 VM, the GUI also streams it to a temporary file on your machine for Wireshark to read.

Why did my capture stop on its own?

A capture runs through one of the nodes on the link. When that node stops, GNS3 stops the capture. Start the node again and start a new capture.

What does "File type is neither a supported pcap nor pcapng format" mean?

Wireshark received data on its input pipe that doesn't start with a pcap header, usually because the tail command did not pass the file through correctly. On Ubuntu 26.04 the cause is the new uutils tail. With GNS3 2.2.60 or later, choose the preset with internal tail in the Packet capture preferences.

Wireshark opens but the packet list stays empty. Is capture broken?

Often not. The link may simply carry no traffic yet, or the traffic you expect takes another path. Ping across that exact link. If the pcap file in the project grows but Wireshark stays empty, the problem is the reader command, not the capture.

GNS3 Wireshark capture not working: how to fix it

You right-click a link, choose Start capture, and nothing useful happens. Wireshark never opens, or it opens with an error such as End of file on pipe magic during open, or it opens and the packet list stays empty. A GNS3 capture is a chain of small steps, and any broken step gives one of these symptoms.

Why it happens

A capture in GNS3 goes through three stages.

The server captures. It picks a running device on the link and writes a pcap file into the project's project-files/captures folder. If neither end is running, the server refuses with Cannot capture because there is no running device on this link. If that device stops, the capture stops too.
The GUI gets the file. When the server is the GNS3 VM or a remote machine, the GUI streams the pcap over HTTP into a temporary file on your computer.
The GUI starts a reader command. That command comes from Edit > Preferences > Packet capture. By default on Windows and macOS it has the form tail -f ... {pcap_file} | wireshark ... -k -i -: tail keeps reading the growing file and pipes it into Wireshark. In the Wireshark manual, -k starts the capture at once and -i - reads packets from standard input.

The common breakages, by stage:

Wireshark isn't where the command looks. The presets expect C:\Program Files\Wireshark\wireshark.exe on Windows, /Applications/Wireshark.app on macOS, and wireshark on your PATH on Linux. If the program can't start, GNS3 shows Can't start packet capture program followed by the system error.
tail fails. Wireshark then gets an empty pipe. On Windows, the bundled tail.exe could not open files under a user name with non-ASCII characters (gns3-gui#3021); GNS3 2.2.45 shipped a newer tail.exe to fix it. On Ubuntu 26.04, the new tail from uutils breaks live capture, and Wireshark reports File type is neither a supported pcap nor pcapng format. (magic = 0x00000000) (gns3-server#2748).
Wireshark can't capture on Linux. Wireshark hands live captures to a helper called dumpcap. On Debian and Ubuntu, if you allowed non-root capture, dumpcap can only be run by the wireshark group, and everyone else gets Couldn't run /usr/bin/dumpcap in child process: Permission denied.
Nothing to see. The capture works but no traffic crosses that link, or security software blocks the stream. In gns3-gui#2130, Bitdefender left Windows captures empty.

The fix

1. Start a node and start the capture

Start at least one device on the link. Right-click the link and choose Start capture. In the Packet capture dialog, keep Start the capture visualization program checked and click OK. If Wireshark was closed, right-click the link again and choose Start Wireshark.

2. Reset the reader command

Open Edit > Preferences (on macOS, GNS3 > Preferences), then Packet capture. Under Preconfigured packet capture reader commands, choose a Wireshark preset and click Set, or click Restore defaults. Check that Automatically start the packet capture application is ticked.

GNS3 keeps the command you saved, even after an upgrade. An old, edited command can survive long after the defaults changed, so resetting it is worth doing first.

On Linux with GNS3 2.2.60 or later, pick Wireshark Live Traffic Capture (with internal tail). It streams the file from inside GNS3 instead of calling tail, which avoids the Ubuntu 26.04 problem. It is the Linux default from that version on.

3. Make the path match your install

Install Wireshark from wireshark.org or your package manager if it is missing. If it lives somewhere else, edit the path in the command. Then test the program on its own:

& "C:\Program Files\Wireshark\wireshark.exe" -v

# macOS
/Applications/Wireshark.app/Contents/MacOS/Wireshark -v
# Linux
command -v wireshark && wireshark -v

If this fails in a terminal, it will fail from GNS3 too.

4. On Linux, allow capture for your user

On Debian and Ubuntu, answer Yes to "Should non-superusers be able to capture packets?" and add yourself to the wireshark group. The Debian Wireshark README gives both commands:

sudo dpkg-reconfigure wireshark-common
sudo usermod -a -G wireshark $(whoami)

Log out and back in so the group applies. The GNS3 Linux install guide adds the wireshark group for the same reason.

5. Generate traffic

Ping from one end of the link to the other. Many devices send almost nothing while idle, so an empty list right after starting can be normal. On Windows, if pings succeed but the capture stays empty, pause your antivirus or firewall suite and try again.

How to check it worked

Look at the capture file first. In the project folder, open project-files/captures and find the .pcap named after the link, for example R1_FastEthernet00_to_R2_FastEthernet00.pcap. Ping across the link and check that the file grows.

The file grows and Wireshark shows packets: everything works.
The file grows but Wireshark is empty or shows an error: the reader command is the problem. Go back to steps 2 to 4.
The file stays at zero bytes: the capture itself isn't running. Check that the node is started, and look in the GNS3 Console panel for an error.

If it still fails

Docker links. Captures on a Docker node go through uBridge. If uBridge has no rights, the server says Cannot start the packet capture: uBridge is not running. See GNS3 "uBridge requires root access".
The GNS3 VM isn't reachable. With a VM or remote server, the pcap is streamed to you. If the GUI has trouble talking to the VM, captures suffer first. See GNS3 "Cannot connect to compute".
You open the file later. You don't need a live view. Stop the capture and open the .pcap from project-files/captures in Wireshark directly.

More GNS3 fixes are collected in the GNS3 troubleshooting guide.

A lighter way to build the lab

If you mostly need a few containers and a capture point, Isothrum's editor lets you draw the lab in the browser, without an account, and export it as Docker Compose files that run with docker compose up. You can then capture with the tools you already know on the host. Our desktop app, coming soon, will run labs locally with packet capture straight into Wireshark.