To effectively capture and analyze traffic, there must be a way to gather the raw traffic from the network, before being processed by the OS. A packet capture or PCap engine provides an API to capture traffic. Wireshark uses one of several capture engines, such as libpcap, WinPCap, AirPCap, and NPCap. Let's begin with libpcap.