Packet Capture PSIPHON and ULTRASURF

[Nedy]

Hello!

Can someone tell me how I can capture packets from an internal ip to see what the user is doing? I mean, I see a user who has a lot of Internet traffic despite having his browsing restricted. How can I to know if teh user are using PSIPHON or ULTRASURF? Can I see something (Intenret page or port) with a packet capture? What would be the syntax to capture the ip user? Thank you!

[PhilipDAth]

If you start in Network-Wide/Clients, and then click on the client, packet capture shows up near the top.

You could also go Network-Wide/Packet Capture, and create a packet capture like the below:

[PhilipDAth]

ps. I tend to change the output to "Download" so I can load it into Wireshark.

[Nedy]

Sorry for my answer after a lot of days. Thank you for your help!