 Protocol analyzers can also be hardware-based, either in probe format or, as is increasingly common, combined with a disk array.These devices record packets (or a slice of the packet) to a disk array.This allows historical forensic analysis of packets without users having to recreate any fault.