GNS3 can capture packets on virtual Ethernet or serial interfaces. It will write the captured output to a libpcap file that may be viewed using WireShark. WireShark may be downloaded on http://www.wireshark.org.
Suppose we want to capture packets passing through the Serial interface on R2 (s0/0). Right-click somewhere along the line representing the link between R1 and R2. Choose Capture.
The drop-down arrow will allow you to choose which interface to monitor (R1 s0/0 or R2 s0/0). WireShark will automatically start, provided it has been configured under the Preferences window.
Notice that we can also choose the encapsulation type for serial interfaces. Choices are HDLC, PPP and Frame-Relay (FR). The default encapsulation for Cisco serial interfaces is HDLC.
Now let’s generate some traffic to test our capture. Ping R2 from R1. Then let’s refresh the WireShark window by pressing Ctrl+R. Scroll down to see the ICMP request and reply packets as a result of the ping. Packets are being captured whether we refresh the window or not.
Let’s back up and talk about the preferences for capturing packets. Choose Preferences from the Edit menu in GNS3. Then click on Capture in the left pane. Now you may specify the working directory for capture files, the command to use to start WireShark, and whether to automatically start WireShark when you choose to capture.
Also, note that you can see the ongoing captures in a window pane that you can activate in View menu-> Docks -> Captures.