While capture is running, do I need to leave the browser tab open or can I close it can come back later?
Pretty sure it would end when your browser session does. Not real sure. But if you ssh in and run a tcpdump command, like say
tcpdump -n -i <interface>-W /path/to/somefile.pcap</interface>
That will run until you kill it. You can also download that via the web interface (diagnostics->command prompt) or over via scp. And you can examine the .pcap file at your leisure.
If they are stored, how would I go about locating them and deleting them?
Diagnostics->Command prompt. SSH shell is much easier for this.
Is there a way to run a capture that only records in 20 minute intervals but only keep 5 pcaps at a time??
Sounds like a job for cron and scripts. I wouldn't try and use anything on the gui web interface for that. 20 minutes interval cron jobs running a script that makes sure you only have 5 .pcap files, and then tcpdumps a new one. I don't know of anything analogous to that wireshark command that's a stock utility.
It sounds like you are just worried about storage. pfSense does a have way to integrate remote storage for logs. Not sure if that extends to packet capture. If you can make a firewall rule that matches a filter string and log it to remote storage, then you'd be doing the same thing.
I just noticed the "Count" field. If I set this to something like 250000 would that basically be like retaining only the most recent 250k captures, or does that mean stop logging after 250k is reached?
The latter in my experience.
