Implementations of the present disclosure relate to packet capture for a multi-link device. In the implementations, an access point (AP) obtains a media access control (MAC) address of a multi-link device (MLD) to be monitored. Further, the AP determines a plurality of links of the MLD to be monitored based on the MAC address. Based on the MAC address of the MLD, the AP captures packets transmitted by the AP MLD on the plurality of links, as a monitor AP. For each of the captured packets, the AP inserts the MAC address of the MLD into an MLD MAC field in a packet capture headroom associated with the packet. In this way, the present disclosure can support flexible packet capture (PCAP) for a specific MLD instead of for a specific link.