diff --git a/.github/workflows/__integration_tests.yaml b/.github/workflows/__integration_tests.yaml
index b5e33c6aaf..59cf725c35 100644
--- a/.github/workflows/__integration_tests.yaml
+++ b/.github/workflows/__integration_tests.yaml
@@ -81,6 +81,14 @@ jobs:
           ${{ env.GO_CACHE_KEY }}
           ${{ env.GO_CACHE_KEY_2 }}
 
+    - name: install and start tcpdump capture
+      run: |
+        cat /proc/net/tcp
+        lsof -i tcp
+        ss -tnpo state established
+        sudo tcpdump -i any 'dst port 443' -w /tmp/capture-${{ matrix.suite }}-${{ matrix.router_flavor }}.pcap &
+        echo $! > /tmp/tcpdump.pid
+
     - name: run integration tests
       run: make test.integration-${{ matrix.suite }}
       env:
@@ -95,6 +103,25 @@ jobs:
         # in the test Makefile instead.
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+    - name: stop tcpdump capture
+      if: always()
+      run: |
+        cat /proc/net/tcp
+        lsof -i tcp
+        ss -tnpo state established
+        if [ -f /tmp/tcpdump.pid ]; then
+          sudo kill "$(cat /tmp/tcpdump.pid)" || true
+          sleep 2
+        fi
+
+    - name: upload pcap capture
+      if: failure()
+      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      with:
+        name: pcap-integration-${{ matrix.suite }}-${{ matrix.router_flavor }}
+        path: /tmp/capture-${{ matrix.suite }}-${{ matrix.router_flavor }}.pcap
+        if-no-files-found: ignore
+
     - name: upload diagnostics
       if: always()
       uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0