Ethernet – Packet Slicing when it comes to Ethernet Switches

ethernetpacket-analysis

I don't think it is a standardized term in the industry and hence different people have different interpretation. When folks in Ethernet Switch world refer to packet slicing, what do they really mean? Deep Packet Inspection?

Best Answer

In the context of packet capture, or sniffing, packet slicing means saving only a portion of the captured packet. Rather than saving the entire captured packet, usually just the header is saved. This reduces the amount of storage and processing needed to inspect packets.

For forensic analysis, it is helpful to have the entire packet (for example, to see what the payload is). Some organizations capture every packet that leaves or enters their network. In this way, they can analyze a network attack and see exactly what happened. Of course, this takes a lot more storage space.