Protocol and Packet Analyzers Explained for the Network+ Exam

A protocol analyzer — packet analyzer, packet sniffer, the terms are interchangeable on the exam — captures frames off the wire and decodes them so you can read what the network is actually carrying.

It is the tool of last resort in troubleshooting, and the one that settles arguments. When the application team says the network is slow and the network team says the application is slow, a capture tells you which.

What capture actually involves

Three things have to be true before you see anything useful.

The frames must reach your interface. On a hub every port saw everything; on a switch you only see traffic addressed to you, broadcast or multicast. This is the single most common reason a capture looks empty.

The interface must accept frames not addressed to it. That is promiscuous mode. Without it the NIC discards frames destined for other MAC addresses. On wireless, monitor mode goes further and captures raw 802.11 frames including management and control frames.

You need the privileges. Capture requires administrative rights.

Getting traffic to the capture point

This is where Network+ concentrates, because it is a design decision.

Port mirroring (SPAN). Configure the switch to copy traffic from one or more ports to a monitoring port. Cheap, needs no extra hardware, and configurable on the fly. The caveat matters: a mirror port can be oversubscribed. Mirror two saturated gigabit ports onto one gigabit monitor port and the switch silently drops frames, so your capture is incomplete in exactly the situation you care about.

Network tap. A physical device inserted into the link that passes traffic through and copies it out. It cannot be oversubscribed the way a mirror can, it sees errors and malformed frames a switch would drop, and it keeps working if the switch CPU is loaded. Downsides: it costs money and inserting it means breaking the link. A passive tap keeps passing traffic even if it loses power.

Inline on the host. Capturing on the endpoint itself is simple and needs no network change, but it shows only that host's traffic and may miss what a middlebox altered.

Exam framing: if the question stresses completeness, reliability or capturing errors, the answer is a tap. If it stresses cost and flexibility, it is port mirroring.

Filters

A busy link generates more data than you can read, so filtering is the skill.

Capture filters are applied before writing, so discarded packets are gone for good. Use them when the volume would otherwise be unmanageable.

Display filters are applied to an existing capture, so nothing is lost and you can change your mind. Use them by default.

The practical rule is to capture broadly and filter on display, unless volume forces your hand.

What a capture tells you

Is the traffic arriving at all? If the server never sees the SYN, the problem is upstream — routing, a firewall, an ACL.

Who is not answering? A SYN with no SYN-ACK points at the server or something filtering in between. A RST means something actively refused it.

Where is the delay? Timestamps separate network latency from application think time. A fast handshake followed by a long pause before the response is an application problem, not a network one.

Is there loss? Retransmissions and duplicate ACKs show loss even when interface counters look clean.

Is the protocol behaving? Failed DHCP, DNS returning the wrong record, TLS negotiation failing on a version mismatch — all visible.

Limits

Encrypted payloads stay encrypted. You see the handshake, the certificate, the SNI hostname and the traffic pattern, but not the content — unless you hold the key or terminate TLS at an inspection point.

A capture also shows only what passed that point at that time, which is why intermittent faults are hard: you need the capture running when the fault occurs.

The legal and ethical part

Capturing traffic means capturing other people's data. Get written authorisation, limit scope to what the investigation needs, store captures securely because they may contain credentials in plaintext protocols, and delete them when you are finished. Unauthorised capture is a sackable offence at best and unlawful at worst. The exam does test that you know to get permission first.

Where it appears

Network+ (N10-009) covers analyzers, port mirroring and taps as troubleshooting tools.

CySA+ (CS0-003) uses packet analysis for detection and incident response.

Security+ (SY0-701) treats sniffing both as a defensive tool and as an attack technique on unencrypted protocols.

What to remember

Promiscuous mode is required to see frames not addressed to you; monitor mode is the wireless equivalent. Switches limit visibility, so use port mirroring or a tap. A tap is more reliable and sees errors; a mirror is cheaper and can be oversubscribed. Capture filters discard permanently, display filters do not. Encryption hides payloads but not metadata. And always get authorisation.

Related reading: NetFlow and sFlow · Port numbers to know · Toner and probe