# Introduction to Packet Captures

Network Forensics is the capture, recording, and analysis of network events in order to discover the source of security attacks. The foundational artifact of network forensics is the **Packet Capture (PCAP)** file.

## Why Network Forensics?
Malware can hide on a hard drive using rootkits. Attackers can delete Event Logs. But it is incredibly difficult for an attacker to hide their network traffic from a properly configured network sensor. 
*   *"Packets don't lie."* If data left the building, there is a record of it.

## The PCAP Format
A `.pcap` (or the newer `.pcapng`) file contains a complete, byte-for-byte copy of every network packet that passed a specific point on the network during the capture window.

This is fundamentally different from **NetFlow logs**. 
*   **NetFlow:** Like a phone bill. It tells you *who* talked to *whom*, *when*, and for *how long* (e.g., IP A talked to IP B on port 443 for 5 minutes). It does *not* contain the conversation.
*   **PCAP:** Like a recorded phone call. It contains the metadata *and* the actual data payloads (the contents of the downloaded file, the HTTP GET arrays, the DNS queries).

## Capturing Traffic
To capture traffic, sensors (often running software like `tcpdump` or `Zeek`) are placed at strategic chokepoints in the network:
*   **Ingress/Egress points:** The main firewall connecting the corporate network to the Internet.
*   **Core Switches:** Monitoring internal Lateral Movement (e.g., User VLAN talking to the Server VLAN).
*   **Endpoint:** Capturing traffic directly on a specific laptop using tools like Wireshark.

**Promiscuous Mode:** Normally, a network card only reads packets addressed specifically to its own MAC address. To capture all traffic on a network segment, the network interface card (NIC) must be put into "Promiscuous Mode," telling it to read everything it sees.