Before moving forward, let's look at how the packets are made and what sort of information they carry. Understanding a network packet will not only allow us to gain knowledge, but will also help to hone our network forensics skills. In layman's terms, we can say that a network packet is merely data put together to be transferred from one endpoint/host to another. However, in the depths of a network, an IP packet looks similar to the following:

From the very first raw data on the wire, to becoming an Ethernet frame, to the IP packet, and further, to the TCP and UDP type, and finally, becoming the application data, the information is encapsulated through various layers. Let's see an example of packet encapsulation:

From the preceding example, we can see that on the wire, the packet was only a mere frame that encapsulated Ethernet information containing MAC addresses of both source and destination. The IP header is merely responsible for sending a packet from one endpoint to another, while the TCP header keeps a note of communication between the two endpoints. Finally, we have the data, which is nothing but our layer 7 data, such as HTTP and FTP. We will have a brief look at the IP header structure in the next section.