Live Packet Capture, Traffic Analysis and Deep Packet Inspection

Select observation points for the investigative question: endpoint, mirrored switch traffic, a physical tap, gateway or wireless radio. Map which directions, networks and encapsulations each can see.

Promiscuous mode on a normal switched port does not reveal every peer conversation. Broadcast, multicast, unknown-unicast behaviour and mirror settings affect the actual frame set.

SPAN can omit or drop traffic under configuration and oversubscription. A tap can also lose information downstream because of receiver capabilities, aggregation, buffering or storage. Neither is an automatic “court-grade no-loss” guarantee.

Record interface/link type, source ports or VLANs, capture clock and synchronisation status, snap length, filters, ring settings and available device/sensor loss counters. A particular switch command does not universally expose every drop.

Wireless capture needs compatible radios for the actual band, channel width and link use. Hopping can miss exchanges; multiple directions or radios may need separate capture and careful clock correlation.

Access, interception, privacy and incident-reporting requirements vary by jurisdiction. Obtain appropriate scope for the actual traffic, including third-party or employee data; ownership alone does not settle every legal question.

Wireshark offers interactive dissection, tshark provides compatible command-line analysis, and dumpcap focuses on capture. tcpdump is another capture/read tool. Verify the installed version and actual output format instead of assuming all flags and capabilities are interchangeable.

Illustrative capture filters use pcap syntax such as tcp port 443. A Wireshark display expression such as tcp.port == 443 selects already retained packets. Record both; data discarded by a capture filter cannot be restored by changing the display.

As an authorised lab example, dumpcap -i eth0 -s 0 -b duration:600 -b files:12 -w capture.pcapng requests ten-minute rotation with twelve ring files. Confirm the real interface, format, storage and resulting retention; preserve relevant files before the ring overwrites them.

Do not transfer dumpcap ring options to tcpdump unchanged. A documented command’s timing and file-count semantics must be checked in that tool’s manual. A ring count alone does not establish a fixed historical coverage if capture stops or traffic and limits vary.

Use metadata inspection, structured field exports and suitable splitting tools on copies. Retain commands and source relationships. Choose packet/log/flow retention according to real volume and requirements rather than a universal bank or country template.

Classic PCAP stores a file header and packet records with timestamps and lengths under a link type. PCAPng can hold multiple interfaces and richer optional context. The format does not make the captured content self-authenticating.

In PCAPng, section and interface blocks establish structure; enhanced packet blocks carry packet data. Optional statistics and comments may add useful context. A name-resolution mapping can affect display without being proof of a contemporaneous DNS exchange.

Decryption Secrets Blocks can carry supported secret material, such as TLS key-log entries. Verify the reader, secret type and captured session support. Their presence does not guarantee every encrypted flow can be decrypted.

Adding keys or comments creates a modified derivative. Preserve the original ciphertext capture, document the transformation and hash each output. Do not describe a combined file as automatically satisfying any country’s certificate requirements.

Keys can expose sensitive traffic beyond the question under review. Apply appropriate access controls and disclosure scope. If sharing a sanitised derivative, retain an authorised protected master and document exactly what was removed.

The five-tuple identifies source/destination addresses and ports plus transport protocol at a particular observation point. The same tuple can recur at different times; bidirectional grouping also requires time, state and tool semantics.

TCP sequence numbers support byte-stream ordering, including retransmission and out-of-order arrival. They do not simply increase with capture order. Reassembly can be incomplete or ambiguous when packets are missing, truncated or overlapping.

Flags describe transport behaviour but are not unique attack signatures. RST has legitimate causes, FIN closes a sending direction, and PSH does not prove typed human input or a command-and-control beacon.

Follow Stream reconstructs supported captured bytes; it cannot recover uncaptured content or automatically decrypt application protection. Export Objects support is protocol/version-dependent and may yield partial or transformed content.

Validate any extracted file’s structure and source packet relationship. A reconstructed upload or download needs the relevant direction and coverage, not only a suspicious filename or large byte count.

VoIP interpretation requires captured signalling/media, supported codecs and any needed secrets. Missing packets, encryption, negotiated addresses and clock differences can limit intelligible audio or exact timing.

Network detection can use protocol state, patterns and behavioural relationships. A rule matching a user-agent string establishes a matching observation, not that a particular tool successfully exploited a service.

Preserve rule syntax/version, enabled parser and source coverage. Obfuscation, encryption and logging choices can hide relevant input, while benign tests or text can trigger a match.

DPI tools classify traffic using available fields and heuristics. Application classification can be uncertain, particularly with encrypted or intentionally imitated traffic; record the classifier and confidence/context.

JA3 hashes selected ClientHello fields, while JA3S uses selected ServerHello fields. Their inputs are different. Multiple applications can share a fingerprint, and client updates, extension ordering and deliberate imitation can change or reproduce one.

Encrypted Client Hello can limit meaningful inner-name visibility. A passive capture cannot universally expose all TLS handshake attributes, and a server fingerprint need not remain constant across infrastructure changes.

JARM involves active server probing, unlike a purely passive JA3 observation. Any new probing has a separate time and scope; it is not historical packet evidence.

Use timing, sizes and endpoint relationships to prioritise analysis, then corroborate with process and service records. A periodic flow or familiar fingerprint is not a unique malware-family or operator identity.

IPFIX uses template and data records and supports different transport arrangements. Export messages can contain multiple records, and active/inactive timeouts can split one interaction across records. It is not universally one UDP datagram per completed conversation.

NetFlow variants and sFlow differ; sFlow uses sampling and counters rather than being interchangeable with a complete per-flow export. Preserve templates, sampling rates, exporter identity, time basis and lost-export indications.

Flow records retain selected metadata, not complete payload. Byte counts may refer to different layers or sampled estimates, so a large outbound count is not automatically the size of an exfiltrated document.

Correlate DNS, firewall, endpoint and flow records using appropriate shared fields and justified time windows. Address reuse, NAT, proxies and shared hosting can create misleading joins. Missing DNS does not prove direct-IP malicious access.

Preserve raw sources and query logic alongside the derived timeline. Event time and collection time can differ; an arbitrary sixty-second join does not establish causation.

Honeypots and honeytokens produce useful leads but can also be touched by benign scanners, testing or administration. Maintain isolation and record the deployment and monitoring configuration rather than label every interaction criminal.

Router/switch collection can include running/startup configurations, routes, neighbour/forwarding tables, interfaces, logs and authentication records where supported. These snapshots show collection-time state, not automatically the exact earlier path.

Commands can change logs and operational state. Record collection, privileges and effects. Vendor-specific memory/core capture needs an appropriate supported method; do not treat a core file as a generic complete router RAM image.