Packet capture shows exactly what is happening on the wire. When other tools fail to explain the problem, packet capture reveals the truth.
When to use packet capture:
- Symptoms do not match expected behavior
- Debugging application-level issues
- Investigating security incidents
- Verifying firewall rules are working
Planning your capture:
Identify traffic to capture (IP, port, protocol)
Choose capture location
Set appropriate filters
Capture during problem occurrence
Large captures are hard to analyze. Filter aggressively.