diff --git a/README_maintainers.md b/README_maintainers.md
index 9df150fbfe..81225e6af5 100644
--- a/README_maintainers.md
+++ b/README_maintainers.md
@@ -374,6 +374,35 @@ syntax --option value --sub:option value. Using Valgrind could look like this:
  - we force the logging not to happen asynchronous
  - eventually you may still add temporary `console.log()` statements to tests you debug.
 
+Running tcpdump / windump for the SUT
+-------------------------------------
+Don't want to miss a beat of your test? If you want to invoke tcpdump with sudo, make sure
+that your current shell has sudo enabled. Try like this:
+
+    sudo /bin/true; ./scripts/unittest http_server \
+      --sniff sudo --cleanup false 
+
+The pcap file will end up in your tests temporary directory.
+You may need to press an additional `ctrl+c` to force stop the sudo'ed tcpdump.
+
+On windows you can use TShark, you need a npcap enabled installation. List your devices
+to sniff on using the -D option:
+
+    c:/Program\ Files/wireshark/tshark.exe  -D
+    1. \Device\NPF_{XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} (Npcap Loopback Adapter)
+    2. \Device\NPF_{XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} (Ethernet)
+    3. \\.\USBPcap1 (USBPcap1)
+
+choose the `Npcap Loopback Adapter` number - 1:
+
+    ./scripts/unittest http_server \
+      --sniff true \
+      --cleanup false \
+      --sniffDevice 1\
+      --sniffProgramm c:/Programm Files/wireshark/tshark.exe
+
+you can later on use wireshark to inpsect the capture files.
+
 Debugging AQL execution blocks
 ------------------------------
 To debug AQL execution blocks, two steps are required:
diff --git a/js/client/modules/@arangodb/process-utils.js b/js/client/modules/@arangodb/process-utils.js
index cbdcdf1082..757c8c4422 100755
--- a/js/client/modules/@arangodb/process-utils.js
+++ b/js/client/modules/@arangodb/process-utils.js
@@ -59,6 +59,8 @@ const platform = internal.platform;
 const abortSignal = 6;
 const termSignal = 15;
 
+let tcpdump;
+
 class ConfigBuilder {
   constructor(type) {
     this.config = {
@@ -1310,7 +1312,11 @@ function shutdownInstance (instanceInfo, options, forceTerminate) {
       }
     });
   }
-
+  if (tcpdump !== undefined) {
+    print(CYAN + "Stopping tcpdump" + RESET);
+    killExternal(tcpdump.pid);
+    statusExternal(tcpdump.pid, true);
+  }
   cleanupDirectories.unshift(instanceInfo.rootDir);
   return shutdownSuccess;
 }
@@ -1562,6 +1568,38 @@ function launchFinalize(options, instanceInfo, startTime) {
   });
 
   print(Date() + ' sniffing template:\n  tcpdump -ni lo -s0 -w /tmp/out.pcap ' + ports.join(' or ') + '\n');
+  if (options.sniff !== undefined && options.sniff !== false) {
+    options.cleanup = false;
+    let device = 'lo';
+    if (platform.substr(0, 3) === 'win') {
+      device = '1';
+    }
+    if (options.sniffDevice !== undefined) {
+      device = options.sniffDevice;
+    }
+
+    let pcapFile = fs.join(instanceInfo.rootDir, 'out.pcap');
+    let args = ['-ni', device, '-s0', '-w', pcapFile];
+    for (let port = 0; port < ports.length; port ++) {
+      if (port > 0) {
+        args.push('or');
+      }
+      args.push(ports[port]);
+    }
+    let prog = 'tcpdump';
+    if (platform.substr(0, 3) === 'win') {
+      prog = 'c:/Program Files/Wireshark/tshark.exe';
+    }
+    if (options.sniffProgramm !== undefined) {
+      prog = options.sniffProgramm;
+    }
+    if (options.sniff === 'sudo') {
+      args.unshift(prog);
+      prog = 'sudo';
+    }
+    print(CYAN + 'launching ' + prog + ' ' + JSON.stringify(args) + RESET);
+    tcpdump = executeExternal(prog, args);
+  }
   print(processInfo.join('\n') + '\n');
   internal.sleep(options.sleepBeforeStart);
 }
diff --git a/js/client/modules/@arangodb/testing.js b/js/client/modules/@arangodb/testing.js
index 1d77d96c15..12d2928945 100755
--- a/js/client/modules/@arangodb/testing.js
+++ b/js/client/modules/@arangodb/testing.js
@@ -81,6 +81,10 @@ let optionsDocumentation = [
   '     and logs are removed after termination of the test.',
   '',
   '   - `protocol`: the protocol to talk to the server - [tcp (default), ssl, unix]',
+  '   - `sniff`: if we should try to launch tcpdump / windump for a testrun',
+  '              false / true / sudo',
+  '   - `sniffDevice`: the device tcpdump / tshark should use',
+  '   - `sniffProgramm`: specify your own programm',
   '   - `build`: the directory containing the binaries',
   '   - `buildType`: Windows build type (Debug, Release), leave empty on linux',
   '   - `configDir`: the directory containing the config files, defaults to',
@@ -162,6 +166,9 @@ const optionsDefaults = {
   'sanitizer': false,
   'activefailover': false,
   'singles': 2,
+  'sniff': false,
+  'sniffDevice': undefined,
+  'sniffProgramm': undefined,
   'skipLogAnalysis': true,
   'skipMemoryIntense': false,
   'skipNightly': true,