Use Remote PCAP sessions

Understand the RPCAP boundary

RPCAP streams live packets from one collector interface through the server to Wireshark. Streamed packets are not written to the collector spool, packet database, index, or exports.

Publish the RPCAP listener

Choose one exposure model. To use a dedicated LoadBalancer:

rpcap:
  enabled: true
  controlPort: 2002
  dataPortStart: 2003
  dataPortEnd: 2006
  maxStreamsPerUser: 4
  maxStreamsPerCollector: 4
  service:
    loadBalancerSourceRanges: [10.0.0.0/8]

To reuse the collector LoadBalancer and its external address:

rpcap:
  enabled: true
  service:
    reuseCollectorLoadBalancer: true

To reuse Traefik, configure one plaintext TCP entrypoint per port and enable the generated routes:

rpcap:
  enabled: true
  controlPort: 2002
  dataPortStart: 2003
  dataPortEnd: 2006
  maxStreamsPerUser: 4
  maxStreamsPerCollector: 4
  traefik:
    enabled: true
    ingressClassName: traefik
    entryPointPrefix: rpcap-

Each active stream uses one passive port. The inclusive range 2003–2006 therefore provides a hard global maximum of four concurrent streams; the per-user and per-collector limits prevent any one principal from exceeding that capacity.

ports:
  rpcap-2002: {port: 2002, exposedPort: 2002, protocol: TCP, expose: {default: true}}
  rpcap-2003: {port: 2003, exposedPort: 2003, protocol: TCP, expose: {default: true}}
  rpcap-2004: {port: 2004, exposedPort: 2004, protocol: TCP, expose: {default: true}}
  rpcap-2005: {port: 2005, exposedPort: 2005, protocol: TCP, expose: {default: true}}
  rpcap-2006: {port: 2006, exposedPort: 2006, protocol: TCP, expose: {default: true}}

For Traefik installations that expose a Tartabit-style additionalTcpPorts list, use equivalent name/port entries:

additionalTcpPorts:
  - {name: rpcap-2002, port: 2002}
  - {name: rpcap-2003, port: 2003}
  - {name: rpcap-2004, port: 2004}
  - {name: rpcap-2005, port: 2005}
  - {name: rpcap-2006, port: 2006}

Extend the Traefik list through dataPortEnd. Plaintext RPCAP cannot be routed by hostname, so every port needs a distinct entrypoint. No TLS or PROXY protocol is added.

helm upgrade pcapillary ./pcapillary-<VERSION>.tgz \
  --namespace pcapillary \
  --values pcapillary-values.yaml \
  --values rpcap-values.yaml

RPCAP requires one backend replica because listener allocation and relay state are process-local.

Publish the control and passive ports

rpcap:
  enabled: true
  control_port: 2002
  data_port_start: 2003
  data_port_end: 2034
  max_streams_per_user: 4
  max_streams_per_collector: 4

./pcapillary validate
./pcapillary apply
./pcapillary status

Allow TCP 2002 and TCP 2003–2034 through the host firewall only from approved Wireshark networks.

Create a remote session

1. Open RPCAP in the product console.
2. Select one online collector, one configured interface, and a credential lifetime.
3. Choose Create session.
4. Copy the generated username and reveal or copy its password from the sessions table.

Scoped credentials expose only the selected interface. Expiration or revocation immediately ends an active stream.

Connect to the remote interface

1. Open Capture → Options → Manage Interfaces → Remote Interfaces.
2. Remove any saved entry for the same host if it previously used different credentials; Wireshark caches interfaces by host and port.
3. Add the Pcapillary server host and control port 2002.
4. Select password authentication and paste the scoped username and password.
5. Expand the host, choose the advertised interface, optionally add a capture filter, and start.

Use the RPCAP page to track active and recent streams, packet and byte totals, drops, and stop reasons. Revoke the session when it is no longer needed.