thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Networking Fundamentals · Foundational

Packet Capture (pcap)

The recording of network packets for analysis, and the file format (pcap/pcapng) that stores them.

Definition

Captures provide ground truth for troubleshooting and forensics but may contain sensitive data and grow large quickly.

Example

A 5-minute capture during a failed login is shared with the vendor as a pcapng file.

Exam tip

Captures need a SPAN, tap or host-based capture on switched networks.

Related terms