From the course: CompTIA Advanced Security Practitioner (CASP+) (CAS-004) Cert Prep

Unlock this course with a free trial

Join today to access over 24,900 courses taught by industry experts.

PCAP files

PCAP files

From the course: CompTIA Advanced Security Practitioner (CASP+) (CAS-004) Cert Prep

Start my 1-month free trial Buy for my team

PCAP files

“

- In this lesson, we're going to discuss packet captures. Now a packet capture file, or PCAP file, is a data file that contains all the live network packet data from layers two through seven of the OSI model. This file can then be analyzed using a packet analyzer like Wireshark in order to reconstruct the different network communications that occurred to and from a given endpoint. As a cybersecurity practitioner, you need to know how to collect and analyze information in a packet capture file. To do this, you're going to first capture the network traffic and its data frames. To help you with this, you're going to use a switch port analyzer or a SPAN port. Now this is sometimes also called a mirror port. A SPAN port or a mirror port is going to allow for copying of ingress and egress communications from one or more switch ports to another. Essentially, it's going to make a copy of everything going in or out of a port, and then put that onto a duplicate port where you can capture it or…

Contents