Describe the educational, diagnostics, network baseline measurements, and security reasons to capture network traffic.

Question

What will be an ideal response?

Answer 1

For educational purposes. Taking the time to examine a series of captured packets is a great learning experience. If you have wondered what really goes on behind the scenes when a Web page is loading, or an email is being sent, analyzing the captured traffic will show you.

For diagnostics. Perhaps a network device has stopped working, such as a network printer. Is traffic getting to the printer? Is the printer sending any replies or acknowledgements?

For network baseline measurements. It is typically good to know what normal traffic patterns look like on a network. Then anything that diverges from the normal patterns can be investigated.

For security reasons. If an attack is taking place, capturing the traffic will provide evidence that may possibly lead to the identity of the attacker and the techniques used to perform the attack.