TechKnowSurge
NIST NICE K0656 NIST NICE K0939 EC-Council CEH 4.1 CompTIA CySA+ 1.3 NIST NICE K0924 NIST NICE S0872 NIST NICE S0875 NIST CSF DE.CM-01
TechKnowSurge Catalog Videos Capturing
VideoSecurityFree

Capturing

Network traffic analysis relies on tools and techniques like packet capture, network taps, port mirroring, and flow monitoring to inspect data moving across an organization's infrastructure. These methods help security teams detect intrusions, identify malware, prevent data loss, and uncover misconfigured or unauthorized devices.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Capturing and analyzing network traffic gives security and operations teams visibility into everything moving across their infrastructure. Packet capture—intercepting the actual data packets traversing a network—is one of the most direct methods available. Tools like Wireshark can be installed on a local machine to capture packets passing through its network interface, allowing analysts to inspect individual packets in full detail, including raw bit-level data. While packet capture can be performed anywhere on a network, ingress and egress points are particularly valuable targets, since inbound traffic may reveal active attacks and outbound traffic can expose infected machines attempting to communicate with external command-and-control servers. Two primary techniques are used to gain access to traffic on a network link without disrupting it. A network tap is a physical device inserted between two pieces of network equipment—such as a router and a switch—that duplicates all traffic crossing that link to a connected monitoring machine. Port mirroring achieves a similar result through software configuration, creating a copy of all traffic on one switch port and forwarding it to another. Cisco's Switch Port Analyzer, commonly called SPAN, extends this capability across multiple switches, allowing a monitoring station to receive mirrored traffic from a port on an entirely different switch in the network. Packet capture surfaces a wide range of security and operational issues, including unauthorized access, malware communicating with external hosts, data exfiltration, misconfigured devices sending improper traffic, policy violations, unwanted protocols, and failing hardware. However, capturing every packet at a high-traffic boundary generates enormous volumes of data that can be difficult to process. Network flow technologies address this by summarizing traffic into structured records that describe connection behavior—source, destination, protocol, volume, and timing—without storing full packet payloads. Cisco NetFlow is a widely deployed proprietary implementation of this approach, while IPFIX serves as the open, vendor-neutral standard, and additional vendor-specific variants also exist.

What you'll learn

What's covered

Network Monitoring & Capturing

Aligned to

NIST NICE
K0656 Knowledge of network collection tools and techniques
K0939 Knowledge of packet-level analysis tools and techniques
K0924 Knowledge of network analysis tools and techniques
S0872 Skill in performing network data flow analysis
S0875 Skill in performing network traffic packet analysis
EC-Council CEH
4.1 Sniffing
CompTIA CySA+
1.3 Given a scenario, use appropriate tools or techniques to determine malicious activity.
NIST CSF
DE.CM-01 Networks and network services are monitored to find potentially adverse events.

Key terms

Packet
A unit of data formatted for transmission over a network, containing a header, payload, and sometimes a trailer.
Packet Filtering
A firewall technique that inspects packets and allows or blocks them based on source, destination, and protocol.
Ingress Filtering
The practice of monitoring and restricting inbound network traffic based on security policies.
Egress Filtering
The practice of monitoring and restricting outbound network traffic based on security policies.
Port Mirroring
A switch feature that copies all traffic from one port to another port so that a monitoring device can analyze network traffic without disrupting normal operations.
Network Tap
A hardware device installed inline between two network devices that passively copies traffic passing across that link to a separate monitoring port.
Packet Capture
PCAP
Packet Capture is the process of intercepting and recording network packets as they traverse a network interface, used in network forensics, intrusion analysis, protocol troubleshooting, and incident response investigations.
Network Flow Analysis
A method of summarizing network traffic into aggregated metadata records, providing high-level visibility into traffic patterns without capturing full packet contents.
Network Interface Card
NIC
A hardware component that connects a computer to a network.

Topics

Packet Capture Network Traffic Analysis Port Mirroring Network Taps Network Flow Analysis Intrusion Detection Networking

Transcript

There are several different technologies that we can use to capture information that's flowing across our network and analyze that information.

What capturing means

Capturing just means taking into possession, and in this case what we're taking into possession is information that's flowing across our network. The main thing that we're going to be capturing is the packets that are flowing across the network.

One of the most well-known packet capturing software is Wireshark. Wireshark is something you can install on a local machine and then capture packets that are going across that machine, across one of the network interface cards of that machine, so you can analyze it. This is not the only method of capturing information within your network and analyzing it, but it's one of the most prevalent ones that we use. So we see right here a bunch of different packets that flowed across this particular network, and now we can dig into it and analyze it. This is a single packet, looking at a single packet and the information that this single packet gives us, so we can see information in here and dig deep into it to see the actual bits and what it's trying to tell us.

Ingress and egress

Really, there's benefits to monitoring packets anywhere within your network, but a common place where we will capture packets and analyze them is on an ingress or an egress port. What ingress or egress means, essentially, is that ingress is packets that are coming into the network and egress is the packets going out of the network.

What we can do is take a look at the packets coming into the network and analyze them to see if there's any kind of attacker that's coming into our network. It's also really beneficial to hit the egress packets, because then we can see if there's maybe an infected machine that's trying to reach out to a server that's out on the internet or something. So we want to analyze packets that are coming in and out of the network.

Network taps

One way we could do this is with a network tap. A network tap is a piece of equipment that we can install in between two pieces of equipment. So in this case right here we've got a router and we've got a switch. We're going to install the network tap in between here, and now what we can do is connect our laptop into it and we can analyze the information that's going across this interface right here. Essentially what we're doing is it's a way that we can capture all of the data that's going across this link right here.

I did a quick search on Google just for "network tap," and you can see what the network taps look like. They're just a port of something coming in and a port going out, and then you have a port that would go to whatever machine that's going to be doing the monitoring. So it could be very simplistic. It's not a complicated piece of equipment.

What packet capturing can find

Some of the things that we could be finding if we're doing packet capturing:

  • We could find that there's been a hacker that's infiltrated our network, and we can see the communication and what that hacker is hacking into and what they have access to.
  • Perhaps there is malware on our network and it's taking data and sending it to something external. Now we can find that there's malware, and identify that malware and where it's coming from.
  • It also has that data loss prevention aspect as well. If there's data that's flowing outside of our network that shouldn't be flowing outside of the network, capturing these packets can help identify that.
  • We also may find that there's misconfigured equipment on our network that's sending out information it shouldn't be sending out.
  • Maybe we're doing web filtering, and so we can capture web traffic and analyze where web traffic is going and where it's coming from.
  • We could also find unwanted protocols and services, or maybe some sort of faulty equipment that's on our network.

Port mirroring

That is not the only method that we have, though. We can also do something called port mirroring. If we want to see the traffic that's going across this link, what we could do is set this up — maybe this is going across port 148 right here, and so that's the port it's coming across — and now maybe we then mirror that port on 147, and we get a copy now of all the data that's going across this 148 port. So port mirroring is just a way to mirror a port, to duplicate the data that's going across that port.

One example of port mirroring is Cisco's switch port analyzer, or SPAN port. What it is is just a way that Cisco switches will mirror or duplicate a port so it can be sent out. What's great about this is that it doesn't have to be a port on the same switch. It's a feature of Cisco where you could actually be on a whole other switch but then have information being reported to you from a port on another switch. So it's a great way to monitor anywhere within your network, no matter what switch it's on, and monitor a port.

Network flows

One of the problems with packet capturing is it's a lot of information. So if we've got a router right here and we're capturing all of the information that's going in and out of this network, that could be a ton of information. One thing we may want to do is summarize some of that information.

There are already features out there that do exactly that. We call it network flows. A network flow would be able to take some of these packets and then really kind of make some generalizations about what's happening on your network.

A good example of network flows would be NetFlow, and that's by Cisco. So if you have a Cisco device that has this feature, NetFlow, on it, what it can do is these summaries, and it can send you summarizations of the network that's flowing across this network. And then a good example that is more of a generic protocol or generic feature is IPFIX. And then there are other ones out there also that are proprietary, like J-Flow.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →