Packet Capture (PCAP) is the process of recording every packet transmitted across a computer network. The resulting .pcap or .pcapng file contains a detailed record of network communications and can be analysed after the event to investigate cybersecurity incidents, troubleshoot communications, validate network configurations, or perform forensic investigations.
In Industrial Control Systems (ICS) and Operational Technology (OT), PCAP analysis provides one of the most valuable sources of evidence because it records exactly what occurred on the network without modifying the control system.
Related: Network Discovery and Scanning | Network Attacks | Intrusion Detection Systems | Detection-in-Depth | SIEM and Log-Based Detection | TCP/IP Fundamentals | OSI Model
Full PCAP is not the only useful network telemetry. OT monitoring programmes often mix:
| Format | What you get | Typical use |
|---|---|---|
| PCAP / PCAPNG | Full packets (headers + payload) | Deep forensic analysis, protocol decode, malware C2 inspection |
| NetFlow / IPFIX | Flow records (source/destination IP and ports, protocol, flags, bytes, packets, timing) — payload stripped | Long-retention traffic summary; anomaly hunting at scale |
| SNMP / Syslog | Device and security event streams | Operational and security alerting into SIEM / LIDS |
Example anomalies that flow metadata (and PCAP) can reveal include data hoarding, geographic multi-location for the same user, host data loss patterns, segmentation policy violations, unexpected service traffic, and traffic that is abnormal for the time of day.
Every communication on an Ethernet network is broken into small pieces called packets.
A packet contains:
PLC --------------------> SCADA
Ethernet
IP
TCP
Modbus
Read Register 40001
Each layer adds information to the packet.
A PCAP file is simply a recording of these packets.
Think of it as:
CCTV footage for a computer network.
Unlike log files, PCAP contains the actual network traffic.
A PCAP can show:
Packet captures are used for:
Finding why communications fail.
Examples:
Identify:
During an incident investigators need to know:
PCAP provides objective evidence.
Packet captures may be used in:
Packet captures can be collected using:
Mirror switch traffic to a monitoring computer.
Preferred in industrial environments.
Advantages:
Hardware device placed inline.
Advantages:
Often used for permanent monitoring.
Using software such as:
Useful for troubleshooting.
Industrial cybersecurity platforms continuously record traffic.
Examples:
Typical investigation process:
Capture Traffic ↓ Open PCAP ↓ Identify Hosts ↓ Identify Conversations ↓ Identify Protocols ↓ Look for Anomalies ↓ Follow Streams ↓ Extract Files ↓ Create Timeline ↓ Determine Root Cause
Who talked to who?
192.168.1.10 ↓ 192.168.1.100 TCP 502 (Modbus)
Determine:
Examples:
If protocols are unencrypted, examples include:
Passwords may be visible.
Packet captures often reveal:
Wireshark is the world's most widely used packet analysis tool. It allows users to inspect every packet individually.
Ideal for:
Capture directly from:
Analyse previously captured traffic.
Supports thousands of protocols including industrial protocols.
Examples:
Examples:
ip.addr == 192.168.1.20tcp.port == 502modbushttpdnsicmparpReconstruct:
Useful for reading conversations.
Shows:
Displays:
Every field can be expanded.
BruteShark is an open-source network forensic analysis platform designed to automate investigation of PCAP files. Instead of viewing every packet, it extracts high-value forensic artefacts automatically.
Automatically identifies:
Can recover:
When transmitted unencrypted.
Shows:
Extracts transferred:
Builds domain relationships. Useful during malware investigations.
08:01 Login ↓ 08:02 DNS Lookup ↓ 08:03 HTTP Download ↓ 08:05 SMB Connection
NetworkMiner is a Network Forensic Analysis Tool (NFAT). Unlike Wireshark, it reconstructs activity from captured packets automatically. It is designed for forensic investigations.
Automatically extracts:
Can identify:
Automatically builds an inventory:
Host ↓ IP ↓ MAC ↓ Hostname ↓ Operating System ↓ Services
Excellent for:
| Feature | Wireshark | BruteShark | NetworkMiner |
|---|---|---|---|
| Live Capture | ✓ | ✗ | ✗ |
| Open PCAP | ✓ | ✓ | ✓ |
| Packet-level inspection | Excellent | Limited | Limited |
| Automatic evidence extraction | Basic | Excellent | Excellent |
| File extraction | Manual | Automatic | Automatic |
| Credential recovery | Manual | Excellent | Excellent |
| Industrial protocol decoding | Excellent | Limited | Limited |
| Malware investigation | Good | Excellent | Excellent |
| Troubleshooting PLC communications | Excellent | Poor | Poor |
| Timeline generation | Manual | Automatic | Automatic |
| Network forensics | Good | Excellent | Excellent |
Industrial environments commonly analyse traffic involving:
Typical investigations include:
Packet capture and analysis directly support several objectives of the ISA/IEC 62443 series by enabling visibility into industrial communications, validating security controls, detecting abnormal behaviour, and providing forensic evidence following security incidents.
| IEC 62443 Area | Relationship to PCAP Analysis |
|---|---|
| Security Monitoring | Provides visibility into network communications for anomaly detection and operational awareness. |
| Incident Response | Supplies detailed evidence to reconstruct cyber incidents, identify affected assets, and determine attack timelines. |
| Risk Assessment | Reveals communication paths, exposed services, legacy protocols, and trust relationships that influence risk evaluations. |
| Security Zones & Conduits | Confirms that communications occur only between authorised zones and through approved conduits, supporting network segmentation verification. |
| Security Program | Assists ongoing monitoring, auditing, verification of security controls, and continuous improvement activities. |
| Threat Detection | Identifies scanning, reconnaissance, malware communications, lateral movement, unauthorised remote access, and protocol misuse. |
| Asset Inventory | Helps discover active devices, IP addresses, MAC addresses, and industrial services present on the network. |
| Security Validation | Verifies firewall rules, access control policies, protocol restrictions, and network segmentation operate as intended. |
| Forensic Readiness | Preserves high-quality evidence to support investigations, regulatory reporting, and lessons learned after cybersecurity events. |
Note: The ISA/IEC 62443 standards describe security objectives and required outcomes rather than prescribing specific tools. Wireshark, BruteShark, NetworkMiner, and similar PCAP analysis tools are practical implementations that organisations commonly use to demonstrate compliance, validate security controls, support monitoring, and investigate incidents within an IEC 62443 security program.