Network Forensics and Log Analysis
Packets, flows, and logs
Network evidence falls into three layers. Full packet capture (PCAP) preserves content and protocol detail but is storage-heavy and often encrypted. Flow records (NetFlow, IPFIX, sFlow) preserve who talked to whom, when, and how much, without content. Logs - firewall, proxy, DNS, DHCP, VPN, authentication, IDS/IPS - preserve decisions made by infrastructure.
Analysis requires understanding TCP flags and session behaviour, NAT and PAT translation, DNS resolution chains, and TLS metadata (SNI and certificate subjects remain visible even when payload is encrypted). Timestamps are the recurring problem: normalise to UTC, check NTP synchronisation, and quantify clock skew before correlating sources.
Log integrity matters. Logs may be centralised, rotated, or tampered with; absence of a log entry is not proof that an event did not occur. Document retention windows.
Traps
Treating an IP address as a person. Attribution requires correlating NAT translations, DHCP leases, VPN or authentication logs, and endpoint data at the specific time. Ignoring time zones or clock skew breaks correlation. Assuming encrypted traffic yields nothing - metadata often suffices for the question asked.
Worked example: an external IP appears in a firewall log at 14:02 UTC. Resolve it by pulling the NAT table entry for that session, the DHCP lease covering the internal address, the VPN or domain authentication record for the assigned user, and endpoint connection state. Only the combined chain supports attribution to a device or person.