## Packet Capture (PCAP) Fundamentals

A PCAP file contains the raw data captured from the network card.

### The TCP 3-Way Handshake
To understand traffic, you must understand TCP.
1.  **SYN**: "Hi, I want to connect." (Client -> Server)
2.  **SYN-ACK**: "Okay, I see you. I'm ready." (Server -> Client)
3.  **ACK**: "Great, let's go." (Client -> Server)

**Analyst Check**:
*   If you see lots of SYNs but no SYN-ACKs? -> **SYN Flood (DoS)** or **Port Scan** (host is down).
*   If you see SYN, SYN-ACK, RST? -> Connection rejected.

### TCP Flags (The Signal Flags)
*   **SYN**: Synchronize. Start.
*   **ACK**: Acknowledge. Confirm.
*   **FIN**: Finish. Graceful exit. ("I'm done, goodbye").
*   **RST**: Reset. Abort. ("Get lost" or "I crashed").
*   **PSH**: Push. Send data now.

### Protocol Hierarchy
1.  **Ethernet**: MAC Addresses. (Local Network).
2.  **IP**: IP Addresses. (Internet).
3.  **TCP/UDP**: Ports. (Application Service).
4.  **Application**: HTTP, DNS, SMB. (The Data).

When analyzing, work up the stack. First check IP (Who?), then Port (What Service?), then App (What Content?).