PCAP
Packet Capture
Paketmitschnitt
PCAP denotes both the capturing of network traffic and the widespread file format in which the captured packets are stored. A packet capture records network traffic faithfully and is thereby the most important raw material of network forensics. What was not recorded cannot be analysed.
History & facts. A PCAP file contains the captured packets with timestamps and can later be evaluated packet by packet with tools such as Wireshark. It is the most detailed form of network observation — but at the same time storage-intensive, which is why a complete continuous recording is rarely practicable. Frequently, therefore, excerpts are secured specifically or metadata (for instance via Zeek) is retained permanently as a complement.
Outlook & recommendation. The decisive point is the recording itself: afterwards, only what was previously captured can be examined — if the capture is missing, the evidence is missing. A strategy of permanently stored metadata and event-related full captures is sensible. Increasing encryption diminishes the value of the pure content and shifts the analysis towards metadata and patterns. PCAP nonetheless remains the reference for deep, evidentially sound network analysis.