When you need to draw liquid from a container, you use a tap. When you tap into the data stream, you capture the data from the network. Once you capture network traffic, you can analyze the packets to understand the traffic flow. In this chapter, we'll review the network architectures and various types of media that may be found on today's networks to help you to get a better understanding of the complex nature of today's networked environment.

So that you can confidently begin capturing traffic, we'll look at the various options including capture, input, and output. We'll then review what happens when you tap into a network, so you can identify what types of traffic you'll see. We'll also compare and contrast conversations and endpoints, so you understand the difference between the two. Finally, so you can better identify abnormal network behavior, this chapter ends with a discussion on why it's important to baseline network traffic.

This chapter will address all of this by covering the following topics:

• Reviewing the network architecture
• Learning various capture options
• Tapping into the stream
• Realizing the importance of baselining