Packet capture
noun · also PCAP
Recording network traffic packet by packet, usually in PCAP format, so it can be inspected in detail with tools such as Wireshark or tcpdump.
A packet capture records the actual traffic that crossed a network interface: headers and, unless it is encrypted, the content of each packet. Captures are usually saved in the PCAP or PCAPNG format and analyzed with tools such as Wireshark, which decodes hundreds of protocols, or tcpdump on the command line. Network IDS sensors and some security appliances can also store captures around the moments when an alert fired.
Full packet capture produces large volumes of data, so many organizations keep flow records instead, which summarize who talked to whom, when and how much, without the content. Encryption also limits what a capture reveals: for HTTPS traffic, you typically see the destination and timing, not the data.
Example
An analyst suspects a workstation is beaconing to a command-and-control server. A short capture shows the machine resolving the same suspicious domain every 60 seconds and opening a TLS connection to it, with nearly identical request sizes each time, confirming the pattern seen in the firewall logs.
Why it matters for a SOC analyst
Packet captures are the most detailed record of what happened on the network and the best way to confirm or rule out a network-based suspicion. Learning to apply basic Wireshark filters, follow a TCP stream and read DNS and HTTP traffic pays off quickly. Treat captures as sensitive: they can contain credentials and personal data.
Articles that use this term
Tools · · 3 min read
Wireshark for SOC beginners: the filters you will actually use
The Wireshark display filters, views and habits that answer real SOC questions: who talked to whom, what was resolved, and what left the network.
Related terms
- Intrusion detection and prevention system
Tools that inspect network or host activity for signs of attack: an IDS alerts on what it finds, while an IPS can also block it in real time.
- Command and control
The channel attackers use to communicate with compromised systems: sending commands, receiving stolen data and delivering new tools.
- Data exfiltration
The unauthorized transfer of data out of an organization, often the attacker's main goal or the leverage behind a ransomware extortion.
- Digital forensics and incident response
The combined discipline of investigating security incidents with forensic methods while containing and recovering from them.