packet capture
Sometimes a summary is not enough and you need to see the network's raw words — the exact bytes of every message crossing a wire. Packet capture is the act of recording those packets, byte for byte, as they pass a chosen point. If higher-level tools tell you that two computers are talking, packet capture lets you read the actual conversation: which side spoke first, what each said, and where it went wrong. It is the network's equivalent of a court stenographer making a verbatim transcript.
Mechanically, a capture tool puts a network interface into a mode where it hands the operating system a copy of every frame it sees, not just frames addressed to this host. A library called libpcap (or WinPcap/Npcap on Windows) does the low-level grabbing; tools like tcpdump and Wireshark sit on top and present the results. Because saving everything is overwhelming, you almost always attach a BPF filter that tells the kernel which packets to keep — say, only TCP traffic on port 443 to one host — so you record the needle, not the whole haystack. The captured packets can be saved to a .pcap file and replayed or analysed later.
Three honest caveats. First, capture is fundamentally passive: it observes existing traffic and adds nothing, but at high speeds the host may not keep up and will silently drop packets, so an empty result can mean "nothing happened" or "I missed it." Second, you can only capture what reaches your interface — on a switched network you normally see only your own traffic plus broadcasts, unless a port mirror or tap feeds you a copy of others' traffic. Third, those captured packets are real people's data, often readable in the clear for unencrypted protocols, so capturing carries serious privacy, security, and legal responsibilities.
To find out why a login fails, you run "sudo tcpdump -i eth0 -w login.pcap host server and port 443" while you try to log in, then open login.pcap in Wireshark. You can now see the TLS handshake start, the certificate exchange, and the exact point where the connection was reset.
Packet capture records the raw packets crossing an interface; a BPF filter keeps only the ones you care about so you read the needle, not the haystack.
On a modern switched LAN you usually capture only your own traffic plus broadcasts — seeing others' traffic needs a port mirror or tap. And captured packets are real data: treat them with the privacy and legal care that implies.