Blogs | Network Critical

A Complete Guide to Network Packet Capture

Written by Andrew Cutts | Feb 20, 2026 9:22:32 AM

A Complete Guide to Network Packet Capture

Network packet capture is the foundation of everything you do to monitor, troubleshoot, and secure your infrastructure. Without it, your security tools are guessing, your performance data is incomplete, and your forensic investigations lack the evidence they need. Getting packet capture right, and doing it at scale, is one of the most important things any network or security team can do.

This guide covers every stage of the process: choosing your access method, deploying the right hardware, configuring your capture tools, and filtering traffic so your analysis tools receive exactly what they need. Whether you're setting up packet capture for the first time or reviewing your current approach, you'll find everything you need here.

What Packet Capture Is and Why It Matters

Packet capture, sometimes called network packet sniffing or packet recording, is the process of intercepting and recording packets as they travel across a network link. Every captured packet contains a complete record of the data in transit: its source and destination addresses, the protocol in use, timestamps, and the payload itself.

This raw visibility underpins a wide range of use cases across security, performance, and compliance programs.

Security Investigation and Forensics

Security teams replay captured traffic to investigate incidents after they happen. When an alert fires, packet data tells you exactly what happened, what systems were involved, and what data moved. Without a capture record, you're reconstructing events from incomplete log data and working with probabilities rather than facts.

Network Performance Diagnostics

When an application slows down or fails intermittently, packet capture gives you ground truth. You can see whether the problem is in the network, the application, or an external dependency, and pinpoint the exact packet exchanges where latency or errors appear. This level of detail cuts troubleshooting time dramatically compared to working from metrics alone.

Compliance and Audit Evidence

Many regulatory frameworks require organizations to demonstrate that network monitoring controls are in place and functioning. Captured packet data, collected from a complete and reliable access point, provides legally defensible evidence that your monitoring program covers the traffic it's supposed to cover.

What Actually Gets Captured

A full packet capture records every layer of the packet, from the Layer 2 Ethernet header through to the application payload. Depending on your tools and storage capacity, you can capture:

  • Full packet capture: Every byte of every packet, including payload data
  • Packet headers only: Layer 2–4 header information without payload, which reduces storage requirements significantly
  • Sliced packets: A configurable number of bytes per packet, useful for metadata analysis while managing storage volumes
  • Filtered captures: Only packets matching specific criteria, such as a particular IP address, protocol, or port number

Choosing Your Access Method: TAPs vs SPAN Ports

Before any software can capture a packet, you need physical or logical access to the network link where traffic flows. There are two main methods for this: network TAPs and SPAN ports (Switch Port Analyzer, also called mirror ports). The choice between them has significant implications for the completeness and reliability of what you capture.

How Network TAPs Work

A network Test Access Point (TAP) is a dedicated hardware device installed directly into a network link. It splits or copies the traffic on that link and sends an exact duplicate to your monitoring infrastructure, completely independently of the live traffic path.

TAPs are the preferred access method for any environment where complete, reliable capture matters:

  • 100% packet fidelity: Every packet is copied to the monitoring port, including malformed frames and physical layer errors
  • Zero performance impact: Passive fiber TAPs require no power and introduce no latency; copper TAPs operate at line rate
  • No dropped packets: TAPs don't discard packets under load, unlike switch-based SPAN ports
  • Out-of-band operation: The monitoring copy is fully separate from the live traffic path
  • Always-on availability: Passive fiber TAPs have no moving parts and no power dependency, giving you continuous capture even during power events

How SPAN Ports Work

A SPAN port is a software feature on a managed network switch that mirrors traffic from one or more ports to a designated monitoring port. SPAN ports are built into most enterprise switches and require no additional hardware, making them attractive for quick or ad-hoc captures.

However, SPAN ports have serious limitations for production packet capture:

  • Packet loss under load: Switches prioritize live traffic, and SPAN packets are the first to be dropped when CPU or bandwidth is constrained
  • No error frames: SPAN ports typically don't copy malformed or errored packets, which are often the most diagnostically useful
  • Limited session availability: Most switches support only one or two active SPAN sessions, restricting how many tools you can connect simultaneously
  • Merged traffic streams: Some switch implementations combine send and receive streams rather than presenting them as separate channels

Which Method Should You Use?

For security monitoring, compliance programs, and any situation where a complete, forensically defensible packet record is required, use hardware TAPs. SPAN ports are useful for quick troubleshooting captures in environments where a TAP isn't available, but they can't match the reliability or completeness that TAPs provide.

How to Deploy a Network TAP

Deploying a network TAP is straightforward and typically requires a brief planned maintenance window for fiber links. Copper links with bypass capability can often be inserted without a full link-down event.

Step 1: Identify Your Capture Points

Start by mapping the network links where you need visibility. The highest-priority capture points are usually:

  • Internet perimeter links: Traffic crossing your edge firewall or router, where external threats enter and data exfiltration exits
  • Core switching fabric: Inter-segment traffic that wouldn't appear on a perimeter capture
  • Data center interconnects: Links between server clusters, storage networks, or between sites
  • Critical application links: Connections to database servers, authentication systems, payment infrastructure, and other high-value assets

Each link you want to capture requires a TAP. Cover your highest-risk links first, then expand your deployment.

Step 2: Select the Right TAP Type

Your TAP selection depends on the physical link you're tapping:

  • Passive fiber TAPs: For single-mode or multimode fiber links at 1G, 10G, 40G, or 100G. The optical signal is split using a prism or coupler. No power required, no configuration needed, and completely invisible to the network.
  • Ethernet TAPs: For copper (RJ45) links at 1G or 10G. Uses active regeneration to copy traffic at line rate. Includes heartbeat monitoring and automatic bypass to protect network availability if the TAP loses power.
  • Bypass TAPs: For links where inline security appliances are deployed. Continuously monitors the health of inline tools and automatically reroutes traffic around any appliance that stops responding.

Step 3: Install the TAP Inline

For a passive fiber TAP:

  1. Identify the fiber patch cables connecting your two network devices
  2. Insert the TAP inline by routing the cables through the TAP's network ports
  3. Connect your monitoring or capture device to the TAP's monitor ports
  4. Confirm the live link remains up and verify traffic is appearing on the monitor ports

For a copper Ethernet TAP, the process is identical. Bypass-capable copper TAPs allow insertion without a full link-down event, using failsafe circuitry to maintain the live path during installation.

Step 4: Add a Packet Broker for Multi-Link Deployments

If you're capturing from multiple links and need to feed traffic to one or more analysis tools, insert a network packet broker between your TAPs and your capture devices. The packet broker aggregates traffic from multiple TAPs, applies filtering and deduplication, and distributes the right traffic to the right tools.

Without a packet broker in a multi-TAP deployment, managing your capture infrastructure becomes increasingly difficult as your network grows. Every new tool requires new direct connections, filtering is impossible without dedicated hardware, and any change to your tool estate means recabling.

How to Configure a SPAN Port for Packet Capture

When a TAP isn't available and you need a quick capture, here's how to configure a SPAN port on a managed switch.

Step 1: Identify Your Source and Destination Ports

Decide which ports you want to monitor (source) and which port your capture device is connected to (destination). Your capture device plugs into the destination port.

Step 2: Configure the SPAN Session

The exact syntax varies by switch vendor, but the general process is consistent:

  1. Access the switch management interface via CLI or web GUI
  2. Define a SPAN session with a unique session number
  3. Specify the source ports or VLANs to monitor
  4. Specify the destination port where your capture device is connected
  5. Enable both ingress and egress monitoring on the source ports
  6. Activate the session

Enabling both ingress and egress gives you a complete picture of traffic on each source port. Monitoring only one direction is a common mistake that produces an incomplete capture.

Step 3: Verify the Session Is Active

After configuration, check:

  • The session status shows as active in the switch's monitoring output
  • Your capture device is receiving traffic by running a brief test capture
  • No port conflicts exist where the destination port is already in use by another SPAN session

Packet Capture Software: Choosing the Right Tool

With your access method in place, you need software to capture and record the packets. The right tool depends on your capture rate, use case, and storage requirements.

Common Packet Capture Tools

  • Wireshark: The most widely used open-source packet analyzer. Excellent for interactive analysis and troubleshooting on lower-speed links. The graphical interface makes it accessible for occasional use, though it's not suited for sustained high-speed capture.
  • tcpdump: A command-line capture utility available on Linux and macOS. Lightweight, scriptable, and very efficient for targeted captures on specific interfaces. Works well for automated captures triggered by scripts or monitoring systems.
  • Dedicated capture appliances: Purpose-built hardware and software systems designed for continuous, high-speed packet recording with indexed storage for forensic retrieval. These handle the data volumes and sustained capture rates that software tools running on general-purpose servers can't sustain reliably.

Capture File Formats

Most capture tools write to PCAP (Packet Capture) format, the industry standard. PCAP files can be opened by Wireshark, tcpdump, and virtually every network analysis platform. The newer PCAPng format extends this with support for multiple interfaces in a single file and richer metadata, and is increasingly common in modern tooling.

How to Filter Captured Traffic

Capturing everything is valuable for forensic work, but it generates large data volumes and can overwhelm analysis tools. Filtering focuses your capture on the traffic that matters, reducing storage requirements and making analysis faster.

Capture-Time vs Post-Capture Filtering

You have two stages where filtering can be applied:

  • Capture-time filtering: Apply filters before or during capture to reduce what gets written to disk. This is the most efficient approach for high-traffic environments.
  • Post-capture filtering: Capture everything, then filter during analysis. This preserves all data but requires significantly more storage.

For high-volume production environments, the most scalable approach is pre-capture filtering through a packet broker. The SmartNA-XL and SmartNA-PortPlus platforms both support advanced filtering at line rate, including Layer 2–4 filtering by IP address, protocol, port, and VLAN tag.

Berkeley Packet Filter (BPF) Syntax for tcpdump and Wireshark

Berkeley Packet Filter (BPF) syntax is the standard for software-level capture filtering:

  • By host: host 192.168.1.100 captures all traffic to or from a specific IP address
  • By port: port 443 captures HTTPS traffic
  • By protocol: tcp, udp, or icmp isolates traffic by transport layer protocol
  • By network: net 10.0.0.0/8 captures all traffic within a defined subnet
  • Combined filters: host 192.168.1.100 and port 443 narrows capture to a specific host and service

Packet Manipulation at the Broker Level

Beyond filtering, packet brokers can apply additional processing before traffic reaches your analysis tools:

  • Packet slicing: Trim each packet to a fixed byte length, preserving headers while discarding payload. Substantially reduces storage and tool processing load.
  • Header stripping: Remove VLAN tags or tunnel encapsulation headers before delivery, so tools don't need to process headers irrelevant to their function.
  • Payload masking: Mask sensitive sections of packet payloads to meet privacy or compliance requirements without disrupting traffic flow to tools.
  • Deduplication: Remove duplicate packets that arise when the same traffic is captured from multiple TAP or SPAN sources covering overlapping paths. This is managed through the Drag-n-Vu interface on Network Critical's SmartNA platforms.

Best Practices for Reliable Packet Capture

A well-designed capture infrastructure is one you can rely on when it matters most. These principles will help you build something robust from the start.

Design for Completeness First

Identify every network segment where a monitoring gap would create risk, and build your TAP deployment around eliminating those gaps. It's far easier to capture broadly and filter down than to discover a blind spot after an incident has already occurred.

Separate Your Monitoring Network

Connect TAPs and monitoring tools through a dedicated out-of-band management network. This keeps monitoring traffic off your production infrastructure, eliminates the risk of feedback loops, and ensures your monitoring tools aren't visible to potential attackers on the production network.

Protect Inline Tools With Bypass TAPs

If you deploy inline security appliances (such as IPS or SSL inspection devices), always protect them with bypass TAPs. When an inline tool fails or requires maintenance, the bypass TAP automatically reroutes traffic to maintain network availability. Without bypass protection, an inline appliance failure takes the link down with it.

Plan Storage Capacity Before You Deploy

Full packet capture generates substantial data volumes at speed. Use filtering, packet slicing, or selective capture to match your capture depth to your actual analysis and retention requirements, and size your storage accordingly before going live.

Test Your Capture Infrastructure Regularly

Confirm periodically that your TAPs are delivering traffic to your monitoring tools, that your SPAN sessions are still active, and that your capture appliances are recording as expected. Monitoring infrastructure that silently fails is worse than no monitoring at all.

Frequently Asked Questions

What's the Difference Between a Network TAP and a Packet Broker?

A network TAP accesses traffic on a specific link and provides a copy to your monitoring infrastructure. A packet broker sits downstream of one or more TAPs and manages how that traffic reaches your analysis tools, applying filtering, aggregation, deduplication, and load balancing. TAPs collect traffic; packet brokers distribute it intelligently.

Can You Capture Packets on Encrypted Traffic?

Yes, but you'll see ciphertext rather than plaintext payload unless decryption is applied before analysis. Header metadata remains visible even in encrypted traffic: IP addresses, ports, timing, flow volumes, and connection patterns are all accessible without decryption, and this information alone is valuable for security analysis and anomaly detection.

Does Packet Capture Slow Down the Network?

When done correctly with hardware TAPs, packet capture has zero impact on network performance. Passive fiber TAPs require no power and introduce no latency. The risk of performance impact comes from SPAN ports, which consume switch CPU resources and can drop packets under high load.

How Long Should Captured Packets Be Retained?

Retention requirements vary by compliance framework and operational need. Many regulatory programs require between 90 days and 12 months of packet retention for audit purposes. Forensic teams typically want at least 30 days available for incident investigation. Packet slicing and selective capture can significantly extend how far back you can retain data within a given storage budget.

How Network Critical Can Help

Getting packet capture right depends on having reliable, complete traffic access from hardware-level TAPs before anything else. Without that foundation, your capture tools can only work with what they receive, and SPAN ports simply can't guarantee completeness.

Our network TAPs provide guaranteed 100% packet capture across speeds from 1G to 400G, with passive fiber options for zero-power deployment and copper Ethernet TAPs with automatic bypass protection. Every TAP in our range passes all full-duplex traffic simultaneously on separate channels, including errors, so your capture tools see exactly what's on the link.

For environments with multiple capture points or multiple analysis tools, the SmartNA-XL and SmartNA-PortPlus packet broker platforms aggregate traffic from multiple TAPs, apply line-rate filtering and packet manipulation, and distribute the right traffic to the right tools. Managed through the intuitive Drag-n-Vu interface, you can configure and adjust your entire capture architecture quickly and accurately, without touching a command line.

Whether you're building a new capture infrastructure or resolving gaps in an existing deployment, our team can help you design an architecture that delivers complete network coverage and gives your security and analysis tools everything they need to work effectively.