25 July 2026 · 3 min read · Invisintel Technologies
A capture lands on your desk. It is 4 GB. Somewhere inside it is the answer to one specific question — and if you start at frame one and scroll, you will not find it today.
Triage is an ordering problem, not a reading problem. The order below is what we built into Anveshaka Pro's PCAP module, because it is the order that consistently gets an analyst to a lead fastest.
Before anything else, find out what period the capture actually covers. A capture labelled "Tuesday" that turns out to start at 14:20 and end at 14:26 changes the entire investigation — six minutes of traffic will not contain the overnight activity somebody asked you about.
Check the first and last frame timestamps. If they do not bracket the incident you were told about, stop and go back for a better capture. Analysts lose whole days to this.
Build the conversation list before you look at a single packet. You want a table of endpoint pairs ranked by bytes transferred, not by packet count — a host that sent 900 MB in 40 packets is far more interesting than one that sent 900 KB in 40,000.
At this stage you are looking for exactly three things:
should have been idle
Now break the capture down by protocol. What you are checking is whether the mix matches what the network is supposed to be doing.
A finance workstation generating a steady stream of DNS queries at three in the morning is not a DNS problem. It is a tunnelling problem.
Anything unexpected here — unusual ports, protocols the environment does not use, encrypted traffic where you expect plaintext — becomes a filter for the next step.
Only now do you start extracting. Files transferred over HTTP, SMB or FTP, certificates from TLS handshakes, DNS query names, HTTP host headers and user agents. These are what turn a network observation into something you can name.
A certificate with a self-signed issuer and a validity window of exactly one year, presented by a host in a country the organisation does not operate in, is a lead. A DNS query for a domain registered nine days ago is a lead.
By this point you should have a filter narrow enough that reading individual frames is worth the time. If you still do not, the problem is upstream — either the capture does not contain what you need, or the question you were given is too vague to answer.
Write down what you expected to find before you open the capture. Analysts who skip this end up fitting the evidence to whatever they noticed first. The capture does not care what your theory is, and neither should your report.
Keep the original file untouched, work on a copy, and record the hash of both in your notes. If the case goes anywhere, the first question asked will be whether the evidence changed after it reached you.
We build investigation software for law enforcement and enterprise security teams.
Request a Demo