Network Forensics

What it is and why it matters

Every connection a computer makes crosses a network and leaves a trace somewhere along the way. The switch sees the frames. The firewall logs the session. The DNS server records the name that was looked up. The proxy keeps the URL. A full packet capture, if one was running, keeps everything. Network forensics is the work of gathering these traces, lining them up by time and reading them to reconstruct what moved across the wire.

It differs from disk forensics in one important way. Traffic is gone the moment it has passed unless something recorded it. Nothing on the network can be seized later and imaged at leisure. The examiner either has a capture, flow data or device logs from the period in question or has nothing at all, which is why preparation matters as much as analysis. Organisations that log properly and keep their clocks in sync give an investigator something to work with. Those that do not give a guess.

The discipline sits at the centre of intrusion and ransomware cases, where the first question is how the attacker got in and the second is what went out. It also helps in data theft, in disputes about who used a shared connection and in checking what an endpoint's own logs claim, since a compromised machine can lie about itself but finds it harder to lie to the switch.

Types of digital evidence

Full Packet Captures
pcap and pcapng files from a tap, a SPAN port or a capture appliance, holding every byte of the traffic during the capture window, including payloads where the protocol is not encrypted.
Flow Records
NetFlow, IPFIX and sFlow summaries that record source, destination, ports, protocol, byte counts and times for each conversation without the content. They cover far longer periods than packet captures because they are small.
DNS Logs
Queries and answers from the resolver, which show the names a host asked for before it connected anywhere. Malware command servers, phishing domains and data exfiltration over DNS all show up here.
Proxy and Web Gateway Logs
URLs, user names, user agents, response codes and bytes transferred for web traffic that passed through the proxy, often the best record of what a user downloaded.
Firewall and NAT Logs
Allowed and denied connections with the translated addresses, which tie a public IP address and port back to an internal host at a given moment.
Authentication and Access Logs
VPN concentrator, RADIUS, Wi-Fi controller and DHCP lease logs that map a user and a device to an IP address and a time.
Intrusion Detection Output
Suricata or Snort alerts and Zeek logs such as conn.log, dns.log, http.log and ssl.log, which turn raw traffic into structured records the examiner can query.
Device State
Router ARP tables, switch MAC address tables and running configurations captured during the response, which show where a host was physically connected.

Devices and data sources

Network taps and switch SPAN or mirror ports feeding a capture host
Firewalls, next-generation firewalls and unified threat management appliances
Web proxies, secure web gateways and DNS resolvers
VPN gateways, RADIUS servers, Wi-Fi controllers and DHCP servers
Routers and switches that export NetFlow, IPFIX or sFlow
Intrusion detection sensors running Zeek, Suricata or Snort
Endpoint connection records collected with tools such as Velociraptor
Internet service provider records such as IP detail records, obtained through lawful request
Cloud virtual network flow logs for workloads hosted outside the office

How an examination runs

The order matters. Each step protects the one after it.

01
Confirm Authority and Scope
Network monitoring touches the traffic of many people. Record who authorised the collection, which segments and hosts are in scope and what the organisation's monitoring policy and the applicable law allow.
02
Preserve What Exists
Before anything else, stop log rotation on the relevant devices, export existing flow data and copy firewall, proxy and DNS logs for the period. These sources expire on a schedule and will not wait.
03
Decide on Live Capture
If the activity is continuing, place a capture at a tap or mirror port that sees the traffic of interest. Use capture filters so the file stays manageable and record the filter used, since what is filtered out cannot be recovered later.
04
Hash and Document
Hash every capture and log file as it is collected. Note the device, interface, clock setting and time zone and whether the device clock was synchronised to a reliable time source.
05
Normalise Time
Convert every source to one time zone, usually UTC, and correct for known clock drift before building a timeline. A proxy that is five minutes fast will put events in the wrong order.
06
Analyse in Layers
Start with flow and DNS to find the hosts and destinations that matter, then go to packet level for those conversations in Wireshark or NetworkMiner. Let Zeek logs do the heavy counting.
07
Report What the Traffic Shows
State what was observed, what was inferred and what encryption or missing logs prevented. A destination IP address is a fact. Who sat at the keyboard is an inference that needs other evidence.

Tools used in this discipline

Independent profiles: what each tool does, where it stops and what you need to know before using it.

Browse the full tools directory

Terminology

Packet Capture: A recording of frames seen on a network interface, saved in pcap or pcapng format. pcapng also stores interface details and comments.
Flow Record: A summary of one conversation, with addresses, ports, protocol, start and end time and byte counts, exported by routers and switches.
SPAN Port and Tap: Two ways to see traffic. A SPAN or mirror port makes the switch copy traffic to a monitoring port. A tap is a passive hardware device in the cable path that does not drop packets under load.
Berkeley Packet Filter: The filter language used by tcpdump and by Wireshark capture filters to keep only the traffic that matters, for example traffic to one host or port.
Display Filter: Wireshark's richer filter applied after capture, used to pick out a protocol, a conversation or a field value in a file that was captured whole.
Session Reconstruction: Reassembling the packets of one TCP connection into the stream the applications saw, so that a web page, an email or a transferred file can be read or extracted.
Network Address Translation: The firewall's practice of presenting many internal hosts behind one public address. NAT logs are the only link between the public address seen by a victim and the internal host.
TLS and SNI: Transport Layer Security encrypts the content of most web traffic. The Server Name Indication field in the handshake still names the site being visited in clear text unless Encrypted Client Hello is in use.
JA3 and JA4 Fingerprints: Hashes of the way a client sets up its TLS handshake, used to recognise a particular piece of software or malware even when the content is encrypted.

Challenges and limits

What makes it hard

Most traffic is encrypted, so content is rarely readable. The examiner works from metadata, handshake details, sizes and timing, or decrypts only where keys are lawfully available, for example from a session key log on a managed endpoint
Full packet capture of a busy link fills storage within hours, so captures are short or filtered and gaps are the norm
Logs rotate and flow exports expire. By the time an incident is noticed, the period that matters may already be gone
Clocks on network devices drift or sit in different time zones, and a timeline built on them is wrong until corrected
Carrier-grade NAT, VPNs and proxies put many users behind one address, so an IP address alone identifies a connection point, not a person
DNS over HTTPS and other encrypted DNS move name lookups out of the resolver logs the organisation controls
Attackers who control a device can erase or alter its logs, which is why evidence from several independent devices carries more weight than any one of them

Keeping the evidence intact

Capture with a tap or mirror port that only reads traffic, and never run the capture on the compromised host itself if another point exists
Hash every pcap and log file at collection and keep the hashes in the case record with the device name, interface and time zone
Record the capture filter, the tool version and the start and stop times, because a filtered capture is incomplete by design and the report must say so
Preserve raw logs as exported, and keep parsed or converted copies separately so that a reviewer can go back to the original
Note the time source of each device and any correction applied, so that every timestamp in the report can be traced to its raw value

Standards and legal considerations

NIST SP 800-86
Guide to Integrating Forensic Techniques into Incident Response. Its data sources chapter covers network traffic, firewall and intrusion detection logs and the analysis process used on this page.
Read the guide
CERT-In Directions 2022
Directions under section 70B(6) of the Information Technology Act, 2000 that require covered organisations in India to keep ICT system logs for 180 days, synchronise clocks with NIC or NPL time servers and report incidents within six hours. They decide what logs an Indian examiner can expect to find.
Read the guide
ISO/IEC 27043:2015
Incident investigation principles and processes, including the readiness work that makes network evidence available when an incident happens.
Read the guide
ISO/IEC 27037:2012
The general rules for collecting and preserving digital evidence, which apply to capture files and exported logs as much as to disks.
Read the guide

In practice

Finding the Exfiltration Host
After a ransomware note appears, the response team pulls firewall flow records for the previous fortnight. One internal server shows nightly transfers of several gigabytes to a single foreign address on port 443, starting ten days before the encryption. The proxy logs name the destination and the DNS logs show the first lookup of that name at 02:14 on the first night, which becomes the earliest known attacker activity.
Who Used the Office Wi-Fi
An abusive message is traced by the recipient's platform to the public IP address of a small company. The NAT log on the firewall maps that public address and port at the stated minute to an internal address. The DHCP lease log maps the internal address to a device MAC address and the Wi-Fi controller maps the MAC to a user login. Each hop is documented and the chain is reported with its limits.
A Capture That Could Not Be Read
An examiner is handed a two-hour pcap and asked what documents were uploaded. The traffic to the cloud storage service is TLS encrypted and no session keys exist. The report gives the destination, the timing and the volume uploaded in each burst, states clearly that file names and contents are not recoverable from the capture and points to the endpoint and the provider's audit log as the places to look.

This page is educational material, not legal advice. Laws and standards change, commence on different dates and are interpreted differently across jurisdictions. Always read the official text linked on this page and take advice from a qualified professional for a real matter.

Learn it at DFRTI

Free pages explain. These courses teach it on real devices with a mentor.

NetworkNetwork & Cloud ForensicsNetwork Traffic AnalysisRead flows, logs and packets to trace intrusions, beaconing and data theft.IntermediateDCNI

NetworkNetwork & Cloud ForensicsWireshark / Packet CaptureCapture, filter and read packets in Wireshark and tshark to recover what was sent.BeginnerDCNI

MalwareIncident Response & Malware AnalysisRansomware & Threat ResponseHandle a ransomware attack from first call to recovery, reporting and lessons learnt.IntermediateMalware Analyst

LegalFoundation & Legal CoursesBasics of Cyber ForensicsStart here. Evidence handling, imaging, hashing, chain of custody and your first analysis.BeginnerDCFA

Standards for this area

Careers that use it

Questions people ask

Can network forensics show what was inside an encrypted connection?

Usually not. It shows who connected to what, when, how much data moved and the fingerprint of the software that made the connection. Content is readable only where the protocol is unencrypted or where decryption keys are lawfully available, such as a session key log from a managed endpoint or a TLS inspection proxy that the organisation operates openly.

Is monitoring employees' network traffic legal in India?

An organisation may monitor its own network for security and policy reasons, but the Digital Personal Data Protection Act, 2023 and the organisation's own policies shape what is proportionate and what staff must be told. Examinations should be authorised and scoped in writing. This page is education, not legal advice.

How long should logs be kept?

The CERT-In Directions of April 2022 require covered entities to keep logs for 180 days within India. Many organisations keep them longer. An examiner should find out the retention policy of each source early, because the window that matters may be closing.

Does an IP address identify a person?

No. It identifies a connection point at a moment in time. Turning it into a device needs NAT and DHCP logs, and turning a device into a person needs authentication records or other evidence. Each link in that chain should be shown in the report.