Overview
To analyze network traffic you first have to capture it. Packet capture records the actual data crossing a network, letting you inspect exactly what happened. This lesson introduces the concepts behind capturing packets, using tools like Wireshark and tcpdump as reference points.
Learning objectives
- Explain what packet capture is and how it works.
- Understand promiscuous mode and capture placement.
- Recognize the legal and ethical boundaries of capture.
Core concept
Packet capture is recording network frames as they traverse a link, for later or live inspection. A capture tool reads packets from a network interface and stores them (often in a .pcap/.pcapng file). Two concepts matter:
- Capture placement — you only see traffic that reaches your capture point. On a switched network, a device normally sees only its own traffic plus broadcasts, so capturing others' traffic requires a suitable vantage (e.g. a monitoring/SPAN port or a tap).
- Promiscuous mode — an interface setting that accepts all frames it sees, not just those addressed to it, which is necessary for capturing traffic beyond your own.
How it works
The capture tool (e.g. tcpdump on the command line, Wireshark with a GUI) attaches to an interface and reads frames as they arrive, optionally applying a capture filter to limit what is recorded. Each packet is timestamped and stored with its full contents (subject to filters and snap length). Analysts then examine the capture — protocol by protocol, layer by layer — reconstructing conversations and spotting anomalies. Where you place the capture determines what you can possibly see.
Practical example
Investigating a slow connection, an analyst runs a capture on the affected host (or a mirror port) while reproducing the problem. The resulting .pcap contains the DNS lookups, the TCP handshake, and the data transfer. Opening it in Wireshark, they can follow exactly what the host sent and received, timestamped — turning a vague "it's slow" into concrete evidence of where the delay or failure occurred.
Cybersecurity relevance
Packet capture is fundamental to network forensics, intrusion detection, and troubleshooting — it shows ground truth about what crossed the wire. It is equally powerful for attackers (sniffing unencrypted credentials), which is a major reason encryption (TLS) matters. Crucially, capturing traffic you are not authorized to capture is unethical and often illegal; analysis must stay within authorized scope (your own systems, lab environments, or explicit engagements).
Common mistakes
- Expecting to see all traffic on a switched network from an ordinary port — you generally see only your own plus broadcasts.
- Forgetting promiscuous mode / proper placement when trying to capture others' traffic.
- Capturing without authorization — a serious legal and ethical violation.
Key takeaways
- Packet capture records frames from a network interface for live or later analysis (e.g. tcpdump, Wireshark), stored as pcap files.
- You only see traffic that reaches your capture point; promiscuous mode and proper placement (SPAN port/tap) are needed to see beyond your own traffic.
- Capture is essential to forensics and detection but must always stay within authorized scope — unauthorized capture is illegal/unethical.
Check your understanding
- Why does capturing on an ordinary switch port usually not show you other devices' traffic, and what is needed to change that?
- What ethical/legal boundary must always be respected before capturing network traffic?