Day 1 - PCAPs or It Didn't Happen: Network Traffic Analysis for Security Practitioners

PCAPs or It Didn't Happen: Network Traffic Analysis for Security Practitioners Marcelle Lee In cybersecurity, assumptions are useful, but evidence is better. Network traffic often provides the clearest record of what actually happened, whether you're investigating suspicious activity, troubleshooting applications, validating alerts, or understanding normal operations. This hands-on workshop introduces participants to the fundamentals of network traffic analysis using packet captures (PCAPs) and network telemetry. Attendees will learn how networks communicate, how to interpret common protocols, and how to systematically analyze traffic to answer real-world investigative questions. Through guided exercises and practical examples, participants will develop skills for identifying anomalies, tracing communications, and extracting meaningful insights from network data. Designed for defenders of all experience levels, this workshop focuses on building a strong foundation in network traffic analysis that can be applied across security operations, incident response, threat detection, and troubleshooting. Participants will leave with practical techniques, an investigative mindset, and the confidence to start making sense of the packets crossing their networks.