You can trigger a capture by going to Capture > Buffers. You should see an Automatic_Capture buffer. Click on the "NAM Alarm" link to configure a capture alarm. Create a new Network Layer Conversation alarm for the variable you want (probably bytes). Configure the various alarm options (i.e. src and dst addresses), then set a rising threshold. This could be small if you want to see all the traffic. The check the radio button to start a capture.
