I am having a hard time understanding certain terminology and setup when it comes to packet capturing. Example. At my company we use NetScout and the various services such as PFS(Packet forwading switch) and TAPs and Infinistream. My problem is what is the difference between a PFS and a TAP? Seems like they do the exact same thing. Also if you look at packet captures and the absolute time, is that the time the data hit the wire of the time that the TAP so the data. Sorry If my question is not all that clear.
Not sure if you meant general packet analysis , but most people use some form of Wireshark and therefore I cannot recommend Jeremy's Cheat cheat Wireshark Cheat sheet enough.
additionally the Wireshark doc page has a wealth of fantastic information including the Wireshark Users Guide
not sure if this answers your question but hopefully is will lead you in the right direction
The nGenius packet flow switches enable the IT organization to better capture monitored traffic with high-density packet aggregation and intelligent filtering capabilities to enable a more flexible and comprehensive approach to capturing, collecting and leveraging important packet flows. Complementary to the widely deployed nGenius InfiniStream appliance, the nGenius packet flow switches are a cost-effective way to further strengthen a pervasive visibility strategy by providing the granular control of packet flows needed for performance management, security monitoring, compliance monitoring, management, UC monitoring, and other similar types of applications.
The NetScout TAP family provides the nGenius InfiniStream appliances and nGenius packet flow switches with full access to network traffic while remaining transparent to the networking infrastructure, and hence causing no disruption to data flows or protocol transactions. The family includes multiple options for link types and speeds to support versatile packet flow capturing at a wide variety of locations in the network hierarchy.
Summary: The Packet flow switches are highly resilient data centre 10g – 40g chassis switches that essentially provides real-time packet flow data to several monitoring applications at the same time
The TAP appliance is deployed transparently inline and then offloads the streams to a single monitoring platform.