If disk space is a concern, use plain tcpdump as described in
You’ll know when you start it how much space will be used. If you have more traffic than expected, you’ll have less time to get the data before it’s overwritten, but that shouldn’t be an issue if the problem is promptly reported. You can of course adjust the command parameters to control how much space will be used.
Having all the network traffic in one place may make it easier to determine the cause, e.g. it may be related to an attempted attack, software update, high jitter on several concurrent calls, etc.