Packet Capture
What is Packet Capture?
The interception and recording of network packets for analysis, troubleshooting, security monitoring, and forensic investigation.
Frameworks that govern packet capture
What the standards actually require on packet capture
Requirements naming packet capture across 4 standards, quoted from the control text.
The Contractor shall preserve and protect images of all known affected information systems identified in the incident review and all relevant monitoring/packet-capture data for at least 90 days from submission of the cyber incident report, to allow DoD to requ...
DFARS-7012-e · Media preservation and protection (90 days) →Support incident handling with automated mechanisms such as online incident management systems and tools for live response data collection, full packet capture and forensic analysis.
fbi-cjis-security-policy::IR-4(1) · IR-4(1) Incident Handling | Automated Incident Handling Processes →The team has software and hardware ready for use (anti-malware, laptops with packet capture, physical tools, checklists), kept in a jump bag that responders can grab. The paper's jump bag list: an incident handler's journal;
sans-incident-handlers-handbook-and-picerl-methodology::P-g · P-g Ready tools in a jump bag: journal, contact list, bootable media, forensic laptop, tool kits, write-blocking duplicators →The owner/operator must make the records necessary to establish compliance available to TSA for inspection or copying on request. TSA may ask for hardware and software asset inventories including SCADA; firewall rules;
tsa-pipeline-cybersecurity-directives::SD02-IV.C · SD02 IV.C Documentation to establish compliance →Questions people ask about packet capture
What is Packet Capture?
Why is Packet Capture important for compliance?
Which compliance frameworks address Packet Capture?
Where can I learn more about Packet Capture?
See how Packet Capture applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.