Well, who actually does packet-level analysis of every connection they make? Maybe some troubled/paranoid individuals are constantly running tcpdump and analyzi

Well, who actually does packet-level analysis of every connection they make? Maybe some troubled/paranoid individuals are constantly running tcpdump and analyzing all the traffic to/from their computer but that can't be a large subset. This sort of discussion is also hard to come by - people/organizations rarely, if ever, actually advertise what kind of traffic analysis / security systems they're running, yet it's extremely interesting (at least to me) and I've always wondered. To detect (and actually analyze) some sort of unknown zero-day you probably need to have entire network packets/connection streams stored so you can see what sort of traffic and data was incoming? Who does that and what sort of system can do that at large enough scale? The topic of moving beyond protection (firewalls etc.) and into actual detection (log analysis, traffic analysis etc.) seems to be rarely discussed.