{"id":15042,"date":"2021-02-17T20:27:04","date_gmt":"2021-02-17T14:57:04","guid":{"rendered":"https:\/\/networkinterview.com\/?p=15042"},"modified":"2021-02-17T20:27:04","modified_gmt":"2021-02-17T14:57:04","slug":"what-is-packet-capture","status":"publish","type":"post","link":"https:\/\/networkinterview.com\/what-is-packet-capture\/","title":{"rendered":"What is Packet Capture?"},"content":{"rendered":"<h1><strong>Introduction to Packet Capture\u00a0<\/strong><\/h1>\n<div class=\"netwo-in-between-content\" id=\"netwo-2738433333\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-1375203873676133\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-1375203873676133\" \ndata-ad-slot=\"2134143805\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><p><strong>\u201cPacket Capture\u201d<\/strong> is defined as network interception of a data packet that is traversing a specific point through a data network. These kind of packets are captured using appropriate tools in real time which are stored for a short stint in order to be analyzed, downloaded, archived or discarded. The reason for capturing and examining network packets, is chiefly for identification of security threats, undesirable network behaviors, network congestions, packet loss and network analysis.<\/p>\n<p>Packet capture is generally <strong>performed via two methods.<\/strong> The first one is <strong>by capturing the whole packet<\/strong> and the second is <strong>by capturing specific portions of a packet<\/strong>. A full packet is made up of two things: a payload and a header. The payload is defined as the main content of the packet, while the header contains metadata, the packet&#8217;s source and the destination\u2019s address.<\/p>\n<h2><strong>Packet Capture Tools<\/strong><\/h2>\n<p>Some of the most frequently used tools across IT ecosystem for packet capturing are enlisted below:<\/p>\n<ul>\n<li><strong>SolarWinds Network Performance Monitor: <\/strong>It is one of the best network monitoring platform in the industry. It contains a network packet analyzer that can capture data from<strong> upto 1200<\/strong> applications at the same time. The most interesting part is the ability to measure packet transfer in real time using the embedded dashboard called <strong>Quality of Experience (QoE).<\/strong><\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-15043 aligncenter\" src=\"https:\/\/networkinterview.com\/wp-content\/uploads\/2021\/02\/what-is-packet-capture-1.jpg\" alt=\"\" width=\"800\" height=\"450\" \/><\/p>\n<p>&nbsp;<\/p>\n<ul>\n<li><strong>Paessler PRTG Network Monitor: <\/strong>This platform is preferred for the internal packet sniffer-bandwidth monitoring service, which uses sensors in order to analyses<strong> IRC AIM, Citrix, FTP, Mail, HTTP, RDP, SSH, <span style=\"color: #0000ff;\"><a style=\"color: #0000ff;\" href=\"https:\/\/networkinterview.com\/what-is-telnet\/\" target=\"_blank\" rel=\"noopener noreferrer\">Telnet<\/a><\/span>, <\/strong>and<strong> VNC <\/strong> The sensors also include a library of the <strong>Top Talkers, Top Connections, <\/strong>and<strong> Top Protocols<\/strong>. Each of these libraries can be visualized as<strong> percentage charts<\/strong>, making accurate estimations on how network resources are consumed across the devices.<\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-15044 aligncenter\" src=\"https:\/\/networkinterview.com\/wp-content\/uploads\/2021\/02\/what-is-packet-capture-2.jpg\" alt=\"\" width=\"800\" height=\"449\" \/><\/p>\n<p>&nbsp;<\/p>\n<ul>\n<li><strong>Wireshark: <\/strong>Wireshark is one of the best choices, when cost savings is one of key and functional requirements. It is a free <span style=\"color: #0000ff;\"><a style=\"color: #0000ff;\" href=\"https:\/\/en.wikipedia.org\/wiki\/Open-source_software\" target=\"_blank\" rel=\"noopener noreferrer\"><strong>open source<\/strong><\/a><\/span> packet analyzer which inspects network traffic in real time. The main advanced service that it offers, is the execution of a <strong>\u201cScan\u201d<\/strong> in order to view the captured packets on screen. The amount of traffic captured can be modified\/abstracted by applying display filters and can be exported in different file formats such as <strong>Text, CSV, XML or Postscript<\/strong>. Another key advantage of Wireshark is the distinction of different type of traffics by using different colors. For example, the user can set blue for TCP and red for UDP traffic. All the color options are available in the user\u2019s interface.<\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-15045 aligncenter\" src=\"https:\/\/networkinterview.com\/wp-content\/uploads\/2021\/02\/what-is-packet-capture-3.jpg\" alt=\"\" width=\"800\" height=\"447\" \/><\/p>\n<p>&nbsp;<\/p>\n<ul>\n<li><strong>ManageEngine Netflow Analyzer: <\/strong>This particular tool can analyze real time network traffic with graphs, using <strong>NetFlow, sFlow, IPFIX, Netstream, J-Flow, <\/strong>and This software tool also provides metrics of the network bandwidth for different users, devices or applications and helps to allocate resources. Additionally, performance issues can be represented in <strong>Pie Charts<\/strong> and exported to various reports according to <strong>Data Points, Time Period, Device <\/strong>and<strong> Type<\/strong>.<\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-15046 aligncenter\" src=\"https:\/\/networkinterview.com\/wp-content\/uploads\/2021\/02\/what-is-packet-capture-4.jpg\" alt=\"\" width=\"800\" height=\"448\" \/><\/p>\n<p>&nbsp;<\/p>\n<ul>\n<li><strong>Collasoft Capsa: <\/strong>This platform is a network analyzer for Windows that monitors packets in real-time. It supports over <strong>1800 <\/strong>different<strong> protocols<\/strong> that the user can monitor through the embedded dashboard technology. Furthermore, dashboard offers network usage visualization with different graphs and charts such as <strong>Top Application Protocols <\/strong>or <strong>Top IP Total Traffic. Colasoft Capsa <\/strong>is suitable for organizations that need a competitively priced network analyzer for Windows.<\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-15047 aligncenter\" src=\"https:\/\/networkinterview.com\/wp-content\/uploads\/2021\/02\/what-is-packet-capture-5.jpg\" alt=\"\" width=\"800\" height=\"450\" \/><\/p>\n<p>&nbsp;<\/p>\n<h2><strong>Conclusion on Packet Capture<\/strong><\/h2>\n<p>This brings us the fag end of the article. Briefly, we discussed about packet capture techniques and how it can be implemented for understanding traffic flow, network troubleshooting, and investigating security incidents.<\/p>\n<p>Previous sections shared some of the best tools in the industry and how they can be used for packet capture and analysis.<\/p>\n<p>It is almost certain that in future need of packet capturing will continue to grow and more research and tools will be created. Every scientist and engineer will hunt for funding opportunities to improve portability, user interface and introduce new techniques for different network traffic loads.<\/p>\n<p>Finally, from a security aspect it must be taken into account that such a technique is helpful in identifying and avoiding network attacks and vulnerabilities. Especially for system and infra administrators, this can be a crucial advantage considering that confidential &amp; business critical information is stored with company\u2019s domain (Company systems only) and not accessible to outside parties or attackers<\/p>\n<p>&nbsp;<\/p>\n<div class=\"netwo-after-content\" id=\"netwo-3328125332\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-1375203873676133\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-1375203873676133\" \ndata-ad-slot=\"2134143805\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>Introduction to Packet Capture\u00a0 \u201cPacket Capture\u201d is defined as network interception of a data packet that is traversing a specific point through a data network. These kind of packets are captured using appropriate tools in real time which are stored &hellip; <\/p>\n","protected":false},"author":146,"featured_media":15048,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1,6674],"tags":[],"class_list":["post-15042","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-techblog","category-configuration"],"jetpack_featured_media_url":"https:\/\/networkinterview.com\/wp-content\/uploads\/2021\/02\/what-is-packet-capture-dp.jpg","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/networkinterview.com\/wp-json\/wp\/v2\/posts\/15042","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/networkinterview.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/networkinterview.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/networkinterview.com\/wp-json\/wp\/v2\/users\/146"}],"replies":[{"embeddable":true,"href":"https:\/\/networkinterview.com\/wp-json\/wp\/v2\/comments?post=15042"}],"version-history":[{"count":0,"href":"https:\/\/networkinterview.com\/wp-json\/wp\/v2\/posts\/15042\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/networkinterview.com\/wp-json\/wp\/v2\/media\/15048"}],"wp:attachment":[{"href":"https:\/\/networkinterview.com\/wp-json\/wp\/v2\/media?parent=15042"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/networkinterview.com\/wp-json\/wp\/v2\/categories?post=15042"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/networkinterview.com\/wp-json\/wp\/v2\/tags?post=15042"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}