I85PREP
⌘ K
CCFH study materials
CCFH study resources

CCFH: Network and Log Forensics

CCFH · Work through your exam, one topic at a time.

All guide sections

Network and Log Forensics

What this domain tests

This domain tests whether you can reconstruct network activity from packet captures, flow records, and device logs, and attribute that activity to a host or user with the right caveats.

Core rules and concepts

  • Capture versus flow. Full packet capture (pcap via tcpdump or Wireshark) preserves payload but is storage-heavy and may drop packets under load; NetFlow or IPFIX records sessions without payload and scale better. State which you relied on and what it cannot show.
  • Log sources. Firewall, proxy, DNS, DHCP, VPN, authentication servers, web servers using combined log format, and endpoint telemetry. Each has its own retention window and timestamp convention.
  • Time discipline. Normalise every source to UTC and record the offset. NTP drift, device-local time, and daylight-saving changes are frequent sources of contradiction.
  • Attribution chain. Public IP to NAT to internal IP to DHCP lease to MAC address to user. Each hop needs evidence and each hop introduces uncertainty.
  • Encryption. TLS payload is unreadable without keys, but metadata remains useful: SNI, certificate fields, JA3 fingerprints, and beaconing intervals.
  • Integrity and retention. Logs may be forwarded to a syslog server or SIEM; check whether hashing, write-once storage, or chain of custody preserves them.

Worked example

A proxy log shows a workstation contacting a suspicious domain at 02:14 UTC. The internal address is NAT-translated, so first map the public address and port at that instant, then pull the DHCP lease covering 02:14 to identify the device and MAC, then match the MAC to an inventory record or 802.1X authentication. The DNS log confirms the lookup, and the firewall flow confirms volume and duration. Only the full chain supports attribution.

Traps that cost marks

  • Comparing logs recorded in different time zones without normalising.
  • Treating a NAT public address as a person or a single machine.
  • Assuming a pcap is complete when the capture dropped packets.
  • Overlooking short DHCP lease times that reassign an address mid-incident.
  • Claiming content from encrypted traffic that only metadata supports.