What is Packet Capture (PCAP)?

Packet capture (PCAP) is the process of intercepting and recording network traffic – the full contents or headers of packets crossing an interface – into a file for later inspection. It underlies network troubleshooting, intrusion analysis, and compliance forensics, letting analysts replay exactly what traveled across the wire.

Key takeaways

• Packet capture records raw traffic for troubleshooting and forensic analysis.
• Captures can be full, filtered, or triggered around a specific event.
• The pcap/pcapng file format is a de facto industry standard.
• Versa NGFW and IDP trigger captures around detected security events.
• Analytics nodes store captures for download and offline inspection.

On this page: Why it matters · How it works · Types · Packet Capture & Versa · FAQ

Why is Packet Capture important?

Most network and security tools summarize traffic – a flow record, a threat alert, a session log – but a summary can hide the detail that explains what actually happened. Packet capture preserves the traffic itself: the exact headers, payloads, and timing of every frame crossing an interface, so an analyst can replay a conversation byte for byte instead of trusting an inference drawn from it.

That matters most when something needs to be proven, not just flagged. An intrusion detection alert says a signature matched; the packet capture around that match shows whether it was a real exploit attempt or a false positive, and what the attacker actually sent. A dropped VoIP call or a slow application response can be diagnosed from flow statistics only up to a point – a capture shows the retransmissions or malformed packets directly. Because captures are resource-intensive, most deployments run them selectively – triggered by a security event or a diagnostic window – rather than continuously.

What is Packet Capture?

A packet capture works by copying packets as they cross a monitored interface, without altering how those packets are actually forwarded. A capture agent – a software library such as libpcap, a hardware tap, or a feature built into a network device – hooks into the interface, matches traffic against an optional filter, and writes each matched packet’s raw bytes and a timestamp to a file.

The de facto standard container for that data is the pcap file format, and its successor pcapng, which most analysis tools read and write interchangeably. Captures can record every byte of every packet or, more commonly at scale, capture only headers or a bounded number of packets around a triggering event, trading storage for the specific detail an investigation needs. Once written, the file is portable: it can be downloaded and opened offline in a protocol analyzer such as Wireshark to reconstruct sessions and diagnose exactly what a device sent or received.

Types of Packet Capture

Full (continuous) capture records every packet crossing an interface for as long as it runs; it gives complete fidelity but consumes disk and CPU quickly, so it is normally reserved for short, deliberate troubleshooting windows.

Triggered (event-driven) capture starts recording only when a condition fires – an intrusion-detection signature match, a policy rule, an anomaly – and captures a bounded window of packets immediately before and after the trigger. This is the most common production pattern because it delivers forensic detail without capturing traffic nobody will review.

Filtered capture narrows what gets recorded using match criteria such as source or destination address, port, protocol, or application, so only traffic relevant to the question at hand is written to disk.

Header-only vs full-payload capture trades detail for volume: headers alone are enough to analyze timing and retransmissions at a fraction of the storage cost of full payloads, which are necessary only when the content itself is under investigation.

Packet Capture & Versa

Versa implements packet capture as a diagnostic feature of the NGFW, IDP, and traffic-monitoring policy engines, configured through Apply Log Export Functionality. For IDP, a vulnerability profile rule enables capture with a configurable pre-window and post-window – packets captured immediately before and after the packet that matched an attack signature (see Configure Intrusion Detection and Prevention). For NGFW, capture is enabled per access policy rule, with a default packet limit (20,000, adjustable from 1,000–50,000) and timeout (600 seconds) set in Logging Control. Traffic-monitoring policy rules can likewise send packet capture data for selected flows.

In every case, captured packets export to the active collector in the associated log export functionality (LEF) profile and land on an Analytics node, because packet capture is resource-intensive on both VOS and Analytics and is recommended only for diagnostics. From the Analytics GUI, administrators view the packet capture log table and download each entry in pcap format – openable directly in Wireshark – or as plain text.

Frequently asked questions

What does PCAP stand for?

PCAP stands for packet capture. The same abbreviation also names the pcap file format that most capture tools use to store recorded traffic, so the term refers both to the activity and to the resulting file.

What is the difference between packet capture and NetFlow?

NetFlow and similar flow protocols record summary statistics about each session – source, destination, byte counts, duration – without the packet contents. Packet capture records the actual packets, including payloads, giving far more detail at a much higher storage and processing cost.

Is packet capture the same as deep packet inspection?

No. Deep packet inspection (DPI) examines packet contents in real time to classify traffic or enforce policy, then discards the packet. Packet capture writes packets to a file for later analysis; a DPI engine can trigger a capture, but the two are distinct functions.

What tool do you use to open a pcap file?

A protocol analyzer such as Wireshark is the standard tool for opening and decoding pcap or pcapng files, letting an analyst filter, follow sessions, and inspect headers and payloads. Command-line tools like tcpdump and tshark can also read pcap files.

Does packet capture affect network performance?

Yes. Capturing and exporting packets consumes CPU and storage on both the capturing device and the collector receiving the data, so most deployments enable it selectively – around a security event or a defined troubleshooting window – rather than continuously in production.

More on Packet Capture

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about Packet Capture, these are worth looking at next.