Full packet capture is the practice of recording every packet crossing a network to disk, not just alerts or summaries, so that the complete raw traffic can be replayed and examined later. Stored in the standard PCAP format, this recording becomes a network equivalent of a security camera: after an incident, an investigator can rewind and see exactly what happened on the wire. The catch is that packets are voluminous, so a site can only keep so much history before it runs out of disk, which turns full capture into a balance between storage cost and how far back you can rewind. This page explains why some OT sites record everything, how the retention window is sized, and the trade-off at the heart of the decision.
Full Packet Capture (PCAP) in one line: Full packet capture, or full PCAP, means recording every packet on a monitored network to disk in the standard PCAP format, so the complete raw traffic can be replayed and analyzed after the fact. In OT it is used for forensics, letting an investigator rewind and reconstruct exactly what happened during an incident down to individual commands. Because packet data is large, the capture is usually a rolling ring buffer with a finite retention window, and sizing that window trades storage cost against how far back in time an investigator can go.
Alerts and logs tell you that something happened, but they rarely tell you everything about how. An intrusion-detection alert notes that a suspicious command was seen; it does not preserve the full sequence of traffic before and after that led up to it, the exact values exchanged, or the other quiet activity that turned out to matter only in hindsight. Full packet capture fills that gap by keeping the raw traffic itself, so an investigator is not limited to what the detection tools happened to flag at the time and can examine anything that actually crossed the wire.
This forensic replay is the core reason OT sites deploy it. After an incident, whether a suspected intrusion, an unexplained process upset, or a device behaving oddly, an analyst can load the captured PCAP and walk through precisely what happened: which device sent which command to which other device, in what order, with what values. Because industrial traffic is deep-parseable, that replay can reconstruct control actions at the command level, showing for example the exact register writes or control operations that occurred, which is often the only way to answer definitively what an attacker or a fault actually did.
Capture is also valuable beyond security. The same recording that answers a security question can answer an engineering one, letting staff replay traffic to diagnose an intermittent communication fault, understand a timing problem, or confirm what a device was reporting at a moment in the past. In an environment where reproducing a transient fault on demand is hard or impossible, having the original traffic on disk means the one time it occurred is preserved for study, which is a strong argument for recording everything rather than only what a tool flagged as interesting.
Full capture is almost always implemented as a ring buffer, a rolling store that keeps the most recent traffic and overwrites the oldest once it fills. The retention window is how far back that buffer reaches, and it is set by a simple relationship: the storage you allocate divided by the rate at which traffic arrives determines how many days or weeks of history you can hold. Faster networks and busier links fill the buffer sooner, so the same disk holds less history on a high-traffic link than on a quiet one.
OT has a helpful property here, which is that control traffic is usually modest and steady compared to enterprise networks. Cyclic polls, periodic reports, and command exchanges generate a predictable, often low, data rate, so a given amount of storage stretches into a much longer retention window than the same storage would on a busy office network. This determinism also makes the window easy to plan, because the traffic rate does not swing wildly, so you can size the buffer for a target number of days with confidence that it will actually last that long.
The right window depends on how long an incident can go unnoticed before someone investigates. If threats or faults are typically caught within days, a short window suffices; if an intrusion might sit undetected for weeks before anyone looks, the capture must reach back far enough to still hold the traffic from when it began, or the forensic record of the origin is already gone. Techniques like capturing only headers, filtering out uninteresting high-volume traffic, or storing full payloads only for selected links can stretch the window without unbounded storage, letting a site keep a longer reach for the traffic that matters most.
At its heart, full capture is a bargain between disk and hindsight. More storage buys a longer rewind, and a longer rewind is worth more the later an incident is discovered, but storage is finite and packet data is heavy, so no site keeps everything forever. The engineering decision is to allocate enough that the retention window comfortably exceeds the realistic time-to-discovery for the threats and faults you worry about, while accepting that beyond that window the raw record is gone and you fall back on the lighter-weight alerts and logs that are kept longer.
This differs from how SCADA historians treat data, and the two are complementary. A historian keeps process values, the tags and trends operators care about, for a very long time at low cost, because a numeric value sampled periodically is tiny compared to raw packets. Full packet capture keeps the underlying network conversation for a much shorter time at much higher cost. Together they let an investigator correlate a long-lived record of what the process values did with a short-lived but exhaustive record of the traffic that carried them, each covering what the other cannot.
For distributed and cloud-connected operations the trade-off has to be managed per site and per link. Capturing full packets at every remote site and shipping it all to a central store is usually impractical over constrained field links, so a common pattern is to capture locally at each site and retain the raw PCAP on-site, while forwarding only alerts, summaries, and selected extracts to a central platform such as Merobix that provides the cross-site view. When an incident at a particular site warrants it, the detailed local capture is there to be pulled and replayed, giving investigators the deep record where it counts without the cost of hauling every packet from every site back to one place.
Long enough that the retention window comfortably exceeds how long an incident might go undetected before anyone investigates. If threats and faults are typically caught within a few days, a short window works, but if an intrusion could sit unnoticed for weeks, the capture must reach back far enough to still hold the traffic from when it began, or the record of the origin is already overwritten. Because control traffic rates are usually modest and steady, a given amount of storage often stretches into a longer window in OT than it would on a busy IT network.
It is heavier than storing alerts or process values, but OT makes it more manageable than in IT. Control traffic is usually modest and steady, so a given disk holds a longer window than the same disk would on a busy office network, and techniques like capturing only headers, filtering out high-volume uninteresting traffic, or keeping full payloads on only selected links stretch the window further. The buffer is also a rolling ring that overwrites the oldest data, so storage is bounded rather than growing forever.
They record different things at different scales. A historian stores process values, the tags and trends operators care about, sampled periodically and kept for a long time cheaply because each value is tiny. Full packet capture stores the raw network conversation itself, which is far larger and kept for a much shorter window. They are complementary: the historian gives a long-lived record of what the process did, while the capture gives a short-lived but exhaustive record of the traffic that carried it, and an investigator often correlates the two.
Merobix reads your field devices into a cloud SCADA - the real thing behind these terms, live in days from any browser.