pcap or it didn't happen

networkingops culture

The network engineer's evidence standard: claims about traffic are settled by a packet capture, not by opinion.

Applications blame the network, the network blames the application, and the pcap ends the argument, because packets do not lie. It is the profession's version of 'citation needed'.

A packet capture is ground truth, and the phrase is deployed when someone describes network behaviour that logs and counters do not corroborate. Everything else in the diagnostic chain is an interpretation: application logs record what the application believed, device counters record what the device counted, and both can be wrong or absent for the case at hand.

The value is settling disagreements that would otherwise persist. When a client team says the requests are being sent and a server team says they are not arriving, a capture at both ends ends the discussion in minutes, and it does so without either side needing to be trusted. That is why the phrase carries a slight edge: it is usually said to someone whose account is not being accepted.

The honest limits deserve stating alongside. Encryption means you observe metadata rather than content unless you can decrypt, which requires keys and raises its own questions. Capturing at scale is expensive and rolling buffers are usually short, so the capture that matters is often the one nobody was running. And capture points are themselves a design choice, since a capture on the wrong side of a translating device shows a true picture of the wrong thing.

← All glossary entries