NetworkNetwork & Cloud ForensicsNetwork Traffic AnalysisRead flows, logs and packets to trace intrusions, beaconing and data theft.Network Forensic Analyst
Network forensics works out what crossed the wire. Packet captures, flow records and logs tell the analyst how an intruder entered, where they went and what left the organisation.
Career guide8 skills5 courses
What the work is
- Captures or collects network traffic lawfully from taps, span ports and sensors and preserves it with hashes like any other evidence.
- Analyses packet captures in Wireshark and at scale in Zeek and Arkime to find sessions, protocols and transferred files.
- Correlates firewall, proxy, DNS, VPN and authentication logs with the traffic to reconstruct an intrusion.
- Identifies command and control traffic, lateral movement and data exfiltration, including inside encrypted sessions through their metadata.
- Extracts files and credentials transferred over the network for the investigation, within the scope of the authorisation.
- Writes a timeline of network events that a non-technical reader can follow and an incident responder can act on.
Skills to build
- TCP/IP, DNS, HTTP, TLS and the common application protocols in detail
- Wireshark filters and protocol dissection
- Zeek scripting and log analysis, Arkime for large captures
- Log formats across network devices, proxies and identity systems
- Encrypted traffic: what the metadata still reveals and what it does not
- Flow analysis and baselining what normal traffic looks like
- Scripting to parse and join large data sets
- Lawful interception limits and privacy law when handling traffic
Tools you will meet
How the role grows
Stages, not promises. Titles differ between employers and the time each stage takes depends on the cases you get to work on.
- 01Network or SOC Analyst
Reads alerts and flows, learns the protocols as they appear on the wire and supports investigations with captures and logs.
- 02Network Forensic Analyst
Owns the network side of an investigation: capture, analysis, correlation with logs and the written timeline.
- 03Senior Analyst or Intrusion Investigator
Leads intrusion reconstructions across many systems, reviews junior analysis and gives evidence on network findings.
- 04Network Security Investigations Lead
Decides what the organisation captures and keeps, builds the investigation capability and works with legal and management on scope.
Start at DFRTI
NetworkNetwork & Cloud ForensicsNetwork Traffic AnalysisRead flows, logs and packets to trace intrusions, beaconing and data theft.
NetworkNetwork & Cloud ForensicsWireshark / Packet CaptureCapture, filter and read packets in Wireshark and tshark to recover what was sent.
MalwareIncident Response & Malware AnalysisMemory ForensicsCapture RAM and use Volatility 3 to find hidden processes, injected code and connections.
MalwareIncident Response & Malware AnalysisRansomware & Threat ResponseHandle a ransomware attack from first call to recovery, reporting and lessons learnt.
LegalFoundation & Legal CoursesBasics of Cyber ForensicsStart here. Evidence handling, imaging, hashing, chain of custody and your first analysis.Disciplines to read first
Questions people ask
Do I need networking certifications?
A networking background, from a certification or from work as a network engineer, gives you the protocol knowledge. It is not compulsory. What matters is reading a packet capture and knowing what normal looks like.
Which course first?
Wireshark / Packet Capture, which starts from capturing and reading traffic. Network Traffic Analysis then moves into investigation. DCNI, the DFRTI Network Investigator certification, is the goal for this track.
Does encryption make network forensics useless?
No, but it changes it. Payloads are hidden, yet connection metadata, DNS, certificate details and timing still tell a story. Endpoint and memory evidence fill the gaps.
Can I capture traffic on any network I can reach?
Only on networks you are authorised to monitor, for the purpose authorised. Capturing the traffic of other people without authority is unlawful and would make the evidence useless anyway.
Career guides describe typical work and skills. They do not promise employment, placement or a salary, and roles vary between employers and countries.
Ready to start?
Tell a counsellor where you are today. They will suggest the first course and the track that leads to this role.