Which type of data must an engineer capture to analyze payload and header information?

Capturing 'full packets' means collecting all bytes of a network frame, including the Ethernet, IP, and TCP/UDP headers, as well as the application layer payload. This comprehensive capture is essential for analyzing both header information at various layers and the actual data content (payload).

The frame check sequence (FCS) is used for error detection at the end of an Ethernet frame and does not contain payload or header information for analysis.

Alert data refers to security notifications and logs generated by systems, not the raw network traffic containing full headers and payloads.

Session logs record metadata about network sessions but typically do not contain the full payload or detailed header information of every packet within a session.