Setting yourself up for packet capture best practices means matching the speed of your Ethernet links to the bandwidth and throughput capabilities of your capture devices. You also have devices that communicate in half duplex mode, which can cause mismatches that result in collisions and minimal throughput. This kind of full duplex traffic makes it difficult to maintain visibility because packets are sent directly to their destinations, bypassing packet capture devices that aren’t directly between two nodes that are communicating.įurther complicating the matter is the fact that not all devices communicate in full duplex mode. Switches allow network devices to send and receive packets at the same time. Compared to the days of Layer 2 network protocols and hubs, packet capture on switch-based networks isn’t straightforward. However, the evolution of Ethernet traffic has made it a bit more complicated than it once was. Doing this effectively requires you to understand the basics in two separate categories-the network side and the capture side.Įxecuting packet capture isn’t necessarily difficult. The Two Sides of Packet Capture Best Practicesīy definition, packet capture refers to the real-time interception of a data packet that crosses or moves over a specific portion of a computer network.

To maximize your network visibility and get the most out of security and monitoring tools, you need to cover your bases on packet capture best practices. Even though it’s a simple concept, so many networking teams fall short on packet capture. Just because you have NetFlow summaries doesn’t mean you have the full picture necessary for deep root cause analysis or security incident reconstruction.

Ultimately, the truth about your network lies in the packets. Without packet capture best practices, you won’t be able to achieve accurate forensics. It’s also about applying digital forensics after the fact to understand what happened, how your network was exploited, and what attackers were able to compromise. Responding to data breaches, for example, isn’t just about mitigating the immediate threat. Without 100% visibility of packets, your tools aren’t getting enough details about activity to accurately identify when issues occur or tell you where those issues occur.Īnd second, gaps in packet capture limit the amount of historical data you can collect, making it difficult to understand network events. As important as your advanced security and monitoring tools are, there are two primary reasons why they make incident response and root cause analysis as efficient as possible with packet capture best practices.įirst, security and monitoring tools can’t get a complete view of your network activity without strong packet capture capabilities. Packet capture is the ultimate tool for troubleshooting your network and protecting it from cyber threats.

Wireshark packet capture bandwidth