Network Forensics

It is a sub-branch of digital forensics. It is related to monitoring and analysis of computer network traffic to collect important information and legal evidence. Looking for evidence by monitoring network traffic, using tools such as a firewall or intrusion detection system.

NamePlatformLicenseDescription
WiresharkWindows, macOS, LinuxOpen SourceNetwork protocol analyzer and packet capture tool
tcpdumpUnix-like systemsOpen SourceCommand-line packet analyzer
SnortWindows, LinuxOpen SourceIntrusion detection and prevention system
Bro/ZeekUnix-like systemsOpen SourceNetwork security monitoring framework
NetworkMinerWindowsOpen Source/ CommercialNetwork forensic analysis tool
XplicoUnix-like systemsOpen SourceNetwork forensics analysis tool
NetWitnessWindows, LinuxCommercialNetwork forensic analysis platform
EncaseWindowsCommercialDigital forensic investigation software
SuricataUnix-like systemsOpen SourceHigh-performance Network IDS, IPS, and Network Security Monitoring (NSM) engine
Cain and AbelWindowsFreewarePassword recovery and network sniffing tool
NgrepUnix-like systemsOpen SourceNetwork grep tool, which allows you to search through pcap files
NetCatUnix-like systemsOpen SourceNetworking utility for reading/writing network connections
NmapWindows, LinuxOpen SourceNetwork exploration tool and security scanner
BroccoliUnix-like systemsOpen SourceAn extension to Bro/Zeek for distributed packet sniffing
SguilUnix-like systemsOpen SourceNetwork security monitoring (NSM) console

Network forensics focuses on investigating captured network traffic (e.g., PCAP files) to identify malicious activities, breaches, or data exfiltration.

Tools and Techniques:

1.Obtain and Preserve PCAP Files: Collect PCAP files from intrusion detection systems (IDS), firewalls, or network monitoring tools. Ensure the files remain unaltered for integrity. Wireshark (Download), tcpdump (Download), Suricata (Download)

2.Load PCAP Files for Initial Inspection: Open PCAP files in analysis tools like Wireshark or NetworkMiner. Filter suspicious traffic using IP addresses, ports, or protocols (e.g., HTTP, DNS).

Example Filters:

http (to view HTTP traffic)

ip.addr == 192.168.1.10 (to filter by IP)

3. Analyze Traffic Behavior

  • Look for abnormal patterns such as:
    • Unusual connections to external IPs.
    • Excessive traffic volume or unauthorized protocols.
    • Encrypted or suspicious DNS queries.
    • Wireshark (Download)

4. Reconstruct Sessions and Extract Artifacts

  • Rebuild HTTP sessions or file transfers to recover malicious files or payloads.

  • Identify malware payloads, emails, or data exfiltration.

5. Correlate with Threat Intelligence

  • Compare suspicious IPs, domains, or URLs with threat intelligence databases.  VirusTotal (Download)

Open-Source Tools:

  1. Wireshark: Analyze PCAP files, filter traffic and inspect protocols. Download
  2. tcpdump: Command-line PCAP capturing and filtering. Download
  3. NetworkMiner: Extract artifacts (files, sessions) from PCAPs. Download
  4. Suricata: Capture network traffic and generate alerts. Download

Commercial Tools:

  1. NetWitness Investigator: Advanced session reconstruction and analysis.Download
  2. Splunk: Analyze and visualize PCAP data alongside logs. Download
  3. SolarWinds Network Analyzer: Traffic analysis and real-time monitoring. Download