PCAP

A recorded set of network packets used for analysis and forensics.

Packet Capture refers to recorded network traffic saved for analysis, troubleshooting, and forensic investigation. Tools that read these files let analysts reconstruct sessions, extract artifacts, and confirm exactly what crossed the wire, which is invaluable during incident response. Because captures can contain sensitive data such as credentials or personal information, they must be stored and handled securely. Full packet capture provides deeper evidence than flow records like NetFlow, which summarize metadata but omit payload contents.