Packet Capture or Flow Records?

About this interactive

A packet capture keeps the packets themselves, so you can see what was inside them: the commands typed in an unencrypted session, a file that crossed the wire, the exact message a device sent. Tools such as Wireshark record traffic from a network card, a network tap or a mirrored switch port. The trouble, as the lesson says, is volume. Capturing everything on a busy link is a mountain of data. Network flows summarize instead: for each conversation they record who talked to whom, on which ports, when, for how long and how many bytes. NetFlow is Cisco's version; IPFIX is the open standard. So ask what the question is about. If it is about what was said, you need the packets. If it is about who, when, where and how much, flow records answer it with a fraction of the data. A capture could answer those too, but it is the heavy tool for the job.

What you'll learn

Decide whether a question about network traffic needs a full packet capture, because it is about what the packets contained, or can be answered from flow records, which summarize who talked to whom, when and how much
Explain why flow records, such as NetFlow and IPFIX, are used when capturing every packet would be far too much data

Aligned to

CompTIA CySA+

1.3 Given a scenario, use appropriate tools or techniques to determine malicious activity.

NIST NICE

K0939 Knowledge of packet-level analysis tools and techniques

S0872 Skill in performing network data flow analysis

S0875 Skill in performing network traffic packet analysis

CompTIA Security+

4.9 Given a scenario, use data sources to support an investigation.

4.4 Explain security alerting and monitoring concepts and tools.

Key terms

Packet Capture: Packet Capture is the process of intercepting and recording network packets as they traverse a network interface, used in network forensics, intrusion analysis, protocol troubleshooting, and incident response investigations.
Network Flow Analysis: A method of summarizing network traffic into aggregated metadata records, providing high-level visibility into traffic patterns without capturing full packet contents.
NetFlow: NetFlow is a Cisco network protocol that collects IP traffic flow metadata including source, destination, protocol, and byte counts, widely used in security operations for traffic analysis, anomaly detection, and incident investigation.
Port Mirroring: A switch feature that copies all traffic from one port to another port so that a monitoring device can analyze network traffic without disrupting normal operations.

Topics

Network Monitoring Packet Capture Netflow Interactive Streak Sort

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →