Before moving forward, let's look at how the packets are made and what sort of information they carry. Understanding a network packet will not only allow us to gain knowledge, but will also help to hone our network forensics skills. In layman's terms, we can say that a network packet is merely data put together to be transferred from one endpoint/host to another. However, in the depths of a network, an IP packet looks similar to the following:
From the very first raw data on the wire, to becoming an Ethernet frame, to the IP packet, and further, to the TCP and UDP type, and finally, becoming the application data, the information is encapsulated through various layers. Let's see an example of packet encapsulation:
From the preceding example, we can see that on the wire, the packet was only a mere frame that encapsulated Ethernet information...