Explain how packet analysis can help a defender identify unusual network behavior, and state one limitation of the method.

### The concept Packet analysis is the inspection of network traffic, often by capturing it live and saving it for later review. A defender can look for unusual behavior, unexpected communication patterns, or unusually high traffic volumes. Such observations may point to a problem, including a possible distributed denial-of-service attack, but traffic volume alone does not establish the cause. Captures may contain a great deal of data, so filters and context are important. ### What a good answer covers - How traffic is captured and inspected. - Examples of unusual patterns or excessive traffic. - Why analysis can suggest, but not automatically prove, an attack. - The need to filter and interpret large captures.