Industrial Cybersecurity

Network packet capturing

Packet capturing is the act of intercepting network data packets that cross or move over a specific computer network and store those data packets in a file. The packet captures can help with diagnosing networking problems, investigate security and policy violation, and aid security incident response and network forensics activities.

A typical network packet capture takes the form of a PCAP file, gathered by a sniffing program, such as Wireshark (https://www.wireshark.org/) or tcpdump (http://www.tcpdump.org/). In order to sniff and record packets on the network, these programs need to be able to see the packets come by. This is typically achieved by connecting the sniffing device/computer to a SPAN or MIRROR port ...