network forensics

switched port analyzer(SPAN)

allows for the copying of ingress and/or egress communications from one or more switch ports to another

packet sniffer

hardware or software that records data from frames and passes it to network media using a mirrored port or TAP device

tcpdump(vid 34 for using it)

data-network packet analyzer that runs under CLI and displays TCP/IP that is transmitted or received on a network

wireshark(vid 35 for using it)

free and open source GUI based packet analyzer used for network troubleshooting, analysis, software and communications protocol development, and education

full packet capture(FPC)

captures the entire packet, including the ehader and the payload, for all traffic

flow collector

means of recording network traffic’s metadata and statistics

NetFlow

cisco developed means of reporting network flow information to a structured database

zeek(bro)

hybrid tool that passively monitors a network like a sniffer and only logs data of potential interest

multi router traffic grapher(MRTG)

creates graphs showing traffic flows through the network interfaces of routers and switches by polling the appliances using SNMP

known bad IP address

ip address or range of address that appears on one or more block lists

domain generation algorithm(DGA)

method used by malware to evade block lists by dynamically generating domain names for C2 networks

fast flux network

method used by malware to hide the presence of C2 networks by continually changing the host IP addresses in domain records using domain generation algorithms

secure recursive DNS resolver

allows one trusted DNS server to communicate with other trusted DNS servers to search for an IP address and return it to the client

URL analysis

activity that is performed to identify whether a link is already flagged on an existing reputation list and, if not, to identify what malicious script or activity might be coded within it

HTTP method

a set of request methods to indicate the desired action to be performed for a given resource

HTTP response codes

the header value returned by a server when a client requests a URL

percent encoding

mechanism to encode 8 bit characters that have specific meaning in the context of URLs, also known as URL encoding