Getting back to a technical topic, let’s talk about PCAP. Is an abbreviation for Packet Capture. PCAP is the industry standard format for capturing, storing and analyzing network data.
PCAP was made ubiquitous thanks to ‘libpcap‘, a pretty common *nix library for network monitoring and manipulation. libpcap is enabled via some super simple (to use) tools called tcpdump and tcpreplay. These allow a developer/analyst to work with the data, over real or virtual networks.
Those tools are command linux utilities for experts to use primarily, but they’re simple to get started with. Alternatively, you can use a tool called Wireshark to monitor, capture and analyze network traffic. Wireshark is free, and has some great features around session decoding, traffic analysis and filtering.
Without jumping into too much detail in this post (more information can be found in the video below), we’ll go over some high level information about what a packet looks like.
A packet is a chunk of data, sent across a network. A packet can contain a full message, or can be one component of a much larger stream, that’s used to break up large pieces of data (movies, songs, pictures, etc) into bite sized chunks.
A packet contains a header, which tells the network gear things like source and destination address, timestamp, protocol and packet size. Network data can be classified in different layers, reference the OSI Model. Each layer up from the ‘physical’ layer can be thought of as more specialized.
An example of that would be an HTTP (layer 7) packet, contained in a TCP packet (Layer 4) within an IP packet (layer 3) which is contained in an Ethernet (layer 2) packet. The ethernet packet has very little information in the header. Source, destination and what protocol the next/layer 3 packet it. The address in the ethernet packet is a physical/hardware address. An IP packet is potentially a globally reachable packet ( 220.127.116.11 ) and the TCP packet adds application ports.
Here’s an example of the packet break down for an HTTP request. (( FYI: Wireshark puts layer 7 at the bottom, while I said layer 7 is at the top ))