What is protocol analysis?
Protocol analysis is the process of capturing network traffic (with sniffing programs) and looking at it closely in order to figure out what is going on. As data is sent across a wire, it is “packetized”, meaning broken down into multiple packets that are each sent individually across the network, then reassembled back on the other side. For example, you probably downloaded this document from the network. Since this document is around 45,000 bytes and the typical packet size is 1,500 bytes, it took about 30 packets to deliver this document to you. Below is a sample packet. This packet was taken from a packet sniffer that watch my workstation download this FAQ from my website.
