thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Full Packet Capture (FPC)

Recording complete network packets, including payloads, for detailed analysis and forensics.

Definition

Full packet capture provides the highest fidelity network evidence, allowing reconstruction of sessions, files and commands. It requires large storage, so retention is often short. Encryption limits payload visibility unless decrypted. Tools include tcpdump, Wireshark, Arkime and network TAPs.

Example

tcpdump -i eth0 -w capture.pcap host 10.0.0.5

Exam tip

Packet capture = content; NetFlow = metadata. Choose PCAP when you need payload evidence.

Related terms