Network Forensics
Network Forensics
The Network Forensics domain tests reconstruction of network activity from packet captures, flow records, and device logs, with evidence handling that survives scrutiny. Expect capture placement, timestamps, protocol analysis, NAT and DHCP correlation, and reporting.
Core rules
- Know your evidence sources: full packet capture (PCAP), NetFlow/IPFIX, firewall, proxy, DNS, DHCP, VPN, IDS, and authentication logs. Flows show who talked to whom and when; PCAP shows content and protocol detail.
- Capture from a SPAN/mirror port or network TAP. Size the capture path, set a useful snaplen, use capture filters sparingly, synchronize clocks with NTP, and hash the capture file when it becomes evidence.
- Analysis moves from conversations and endpoints to protocol decode and stream reconstruction. Look for beaconing intervals, unusual DNS queries, TLS metadata, HTTP user agents, SMB activity, and cleartext credential protocols.
- Correlate NAT translations, DHCP leases, VPN assignments, and time zones to attribute an IP address to a device or user at a specific time. A public IP alone rarely identifies a person.
- Maintain chain of custody: label, hash, store securely, and document every transfer and access.
Worked example
Proxy logs show a workstation posting to an unknown domain every 60 seconds. Flow data confirms the periodic connection, and PCAP reveals a consistent TLS server name and payload size. Reasoning: the interval and regularity suggest automated beaconing, but you must correlate the workstation's DHCP lease and authenticated user, check whether other hosts show the same pattern, and preserve the PCAP and logs before blocking the destination.
Traps
Relying only on firewall logs; ignoring NAT or DHCP when mapping addresses; analyzing PCAP without synchronized time; setting snaplen so low that payload evidence is lost; confusing capture filters with display filters; and collecting data beyond legal authorization.