diff --git a/tsnet/tsnet.go b/tsnet/tsnet.go
index c5f1e88d2..b20ee5ab8 100644
--- a/tsnet/tsnet.go
+++ b/tsnet/tsnet.go
@@ -2032,7 +2032,7 @@ func (s *Server) GetRootPath() string {
 // Packets will be written to the pcap until the process exits. The pcap needs a Lua dissector
 // to be installed in WireShark in order to decode properly: wgengine/capture/ts-dissector.lua
 // in this repository.
-// https://tailscale.com/kb/1023/troubleshooting/#can-i-examine-network-traffic-inside-the-encrypted-tunnel
+// https://tailscale.com/docs/reference/troubleshooting/network-configuration/inspect-unencrypted-packets
 func (s *Server) CapturePcap(ctx context.Context, pcapFile string) error {
 	stream, err := s.localClient.StreamDebugCapture(ctx)
 	if err != nil {