Chapter 8: Network and Computer Forensics Review

Comprehensive vocabulary flashcards covering network forensic fundamentals, protocols, host artifacts, network security appliances, and intrusion investigation workflows based on lecture notes.

Network Forensics

The practice of reconstructing communications and host changes using packets, flows, infrastructure logs, and endpoint artifacts.

Network Intrusion Forensics vs. Traditional Computer Forensics

Intrusion forensics often spans many systems and focuses on system logs, credentials, traffic, and volatile evidence, whereas traditional examination often begins from a static device image and user files.

Real-time Capture and Analysis

Collection and inspection of network activity as it occurs, dependent upon sensor placement, throughput, RAM, and storage capacity.

Retrospective Network Analysis

The process of reconstructing earlier network activity from stored packet captures, flow records, and logs.

Packet

A discrete block of data transmitted across a network; an IP packet consists of a header and a payload.

Packet Sniffer

A tool that captures network traffic, such as tcpdump or Wireshark.

Protocol Analyzer

A tool designed to decode captured network traffic and interpret protocol fields and conversational exchanges.

NIC Promiscuous Mode

An operational mode that causes a network interface to accept all frames it physically receives, even if addressed to another interface. It does not induce a switch to forward unrelated traffic to that interface.

Unicast Traffic Capture Methods (Switched Networks)

Techniques for a sensor to view unicast traffic between other switched hosts, accomplished by capturing at a transit point, using an inline network TAP, or configuring a switch mirror/SPAN port.

RAID 0

Disk striping across multiple drives to maximize storage capacity and throughput, offering zero data redundancy.

Clock Skew

Discrepancies among independent device clocks that can misorder event sequences in forensic timelines. Mitigation requires preserving original timestamps and offsets, normalizing working timestamps, and documenting temporal uncertainty.

Managed Service Provider (MSP)

An external organization delivering IT services to client organizations; its broad privileged access makes it a frequent conduit for multi-client compromises.

Proxy Server

An intermediary system that forwards client requests, generating logs that can correlate internal client IPs and timestamps with outbound proxy IP connections.

Squid

A widely used caching web proxy whose access logs and internal cache provide evidentiary leads regarding HTTP/web requests.

URI vs. URL

A URI (Uniform Resource Identifier) identifies a specific resource, while a URL (Uniform Resource Locator) is a type of URI that additionally specifies where or how to access that resource.

Browser Helper Object (BHO)

A legacy Microsoft Internet Explorer plugin/extension loaded automatically alongside the browser; also referenced as a Browser Help Object.

HTTP Method: GET

An HTTP method used to fetch a representation of the specified target resource.

HTTP Method: HEAD

An HTTP method that requests GET-identical response headers without transferring the corresponding response body.

HTTP Method: OPTIONS

An HTTP method utilized to query the communication options and requirements supported by a resource or server.

HTTP Method: POST

An HTTP method that submits an entity representation to the target resource for processing.

HTTP Method: PUT

An HTTP method that creates a new resource or replaces the state of an existing target resource at the specified URI.

HTTP Method: DELETE

An HTTP method requesting the permanent removal of the designated target resource.

HTTP Method: CONNECT

An HTTP method used to establish a bidirectional communications tunnel, commonly utilized for TLS tunneling through an HTTP proxy.

HTTP Method: TRACE

An HTTP diagnostic method requesting the remote recipient to echo back the received request.

HTTP 400 / 401 / 403

Client error status codes corresponding respectively to Bad Request, Authentication Required (Unauthorized), and Forbidden.

HTTP 404 / 405 / 406

Client error status codes indicating Resource Missing or Undisclosed (Not Found), Method Disallowed (Method Not Allowed), and No Acceptable Representation (Not Acceptable).

HTTP 407 / 408 / 409 / 410

Client error status codes indicating Proxy Authentication Required, Request Timeout, Conflict, and Resource Gone.

HTTP 500 / 501 / 502

Server error status codes corresponding to Internal Server Error, Unimplemented Functionality (Not Implemented), and Invalid Upstream Response (Bad Gateway).

HTTP 503 / 504 / 505

Server error status codes indicating Service Unavailable, Upstream Timeout (Gateway Timeout), and Unsupported HTTP Version.

Client-Side vs. Server-Side Scripting

Client-side code (e.g., browser JavaScript) executes within the local user client; server-side code (e.g., PHP) executes directly on the web server to alter server state or render dynamic responses.

Linux /etc/passwd, /etc/shadow, and /etc/group

Core Linux configuration files storing user account records, restricted password hashes, and group definitions, respectively.

Linux ~/.bash_history, ~/.ssh, and /etc/ssh

Standard Linux forensic locations for a user's command line history, personal SSH keys/configurations, and system-wide SSH daemon configuration or host keys, respectively.

Linux /var/log and /var/www/html

Standard Linux directory paths housing system/service log files and default Apache web document root files, respectively.

DHCP (Dynamic Host Configuration Protocol)

A network management protocol that automatically assigns IP address leases and operational parameters (such as subnet masks, default gateways, and DNS servers) to hosts.

DHCPv4 Ports

UDP port $67$ for the DHCP server listening daemon and UDP port $68$ for the DHCP client.

DHCP DORA

The four-step lease negotiation sequence: Discover (locates servers), Offer (proposes lease configuration), Request (selects or renews lease), and ACK (confirms allocation).

DHCPNAK vs. DHCPDECLINE

DHCPNAK is an explicit refusal sent by a server rejecting a client lease request; DHCPDECLINE is sent by a client notifying the server that the offered IP address is already active on the network.

DHCPRELEASE vs. DHCPINFORM

DHCPRELEASE relinquishes an assigned IP lease back to the pool; DHCPINFORM allows a client with an existing IP address to request local configuration parameters without obtaining a new lease.

dhcpd.leases vs. dhcpd.conf

In ISC DHCP environments, dhcpd.leases stores active and historical client lease states, whereas dhcpd.conf defines server configurations, address pools, lease timers, and logging behaviors.

DHCP Starvation

A denial-of-service attack that floods a subnet with fabricated requests to deplete all available IP addresses in a DHCP pool.

Rogue DHCP / DHCP Poisoning

An attack involving an unauthorized DHCP server answering client Discover requests to assign malicious gateway routes, rogue DNS servers, or manipulated settings.

Syslog

A standard message logging protocol permitting network devices, appliances, and applications to transmit diagnostic and event notifications to a centralized collector.

Hub vs. Switch

A Layer $1$ hub repeats incoming electrical/optical signals blindly to all other ports; a Layer $2$ switch inspects incoming frames, populates a MAC table, and selectively forwards unicast traffic to specific destination ports.

Switch CAM / MAC Address Table

A hardware table on a Layer $2$ switch mapping learned source MAC addresses to specific physical switch ports and VLANs; entries age out over time if not refreshed.

Default Gateway

The designated next-hop routing interface configured on an endpoint to forward all network traffic destined outside the local subnet boundary.

Address Resolution Protocol (ARP)

A communication protocol used to resolve a known local Layer $3$ IPv4 address to its corresponding Layer $2$ physical MAC address.

arp -a

A command-line command executed on an operating system to output the local ARP table containing recently resolved IPv4-to-MAC mappings.

Traceroute

A diagnostic utility that maps the network path to a destination by dispatching packets with incrementally increasing TTL or Hop Limit values to elicit ICMP Time Exceeded messages from intermediate routers.

SMTP (Simple Mail Transfer Protocol)

The standard protocol used to transmit electronic mail between mail clients and relays or across authoritative message transfer agents.

MX Record

A DNS Mail Exchange record used by transmitting mail transfer agents to identify the domain's authoritative mail servers and their relative delivery preferences.

Email Received Headers

RFC-compliant email headers added sequentially by each handling MTA, identifying relay hops, transmission timestamps, and apparent sender hostnames. Analysis begins at the trusted recipient edge.

MIME (Multipurpose Internet Mail Extensions)

An internet standard extending email message formats to support non-ASCII text, multi-part payloads, binary attachments, and alternative body representations (such as HTML).

DKIM (DomainKeys Identified Mail)

An email authentication framework enabling organizations to affix cryptographic digital signatures to outgoing email messages, verifying integrity over designated headers and body contents.

DNS Zone

An administrative, distinct boundary within the hierarchical Domain Name System containing records managed by a single administrative entity.

DNS A vs. AAAA Records

An 'A' record maps a fully qualified domain name to a $32$-bit IPv4 address, whereas an 'AAAA' record maps a domain name to a $128$-bit IPv6 address.

DNS CNAME Record

A Canonical Name record within DNS used to map an alias domain name to another canonical domain name.

DNS PTR Record

A Pointer record used within reverse DNS lookup zones to map an IP address back to its corresponding canonical hostname.

Traditional DNS Transport and Port

Operates over UDP or TCP port $53$. TCP transport is historically invoked when a UDP response message exceeds buffer bounds and returns truncated.

Windows Hosts File Path

Stored locally at %SystemRoot%\System32\drivers\etc\hosts, providing local hostname-to-IP overrides that can be manipulated to redirect host network communications.

ICANN vs. IANA

ICANN governs the overall operational stability and global identifier coordination of the internet; IANA functions include allocating top-level global IP blocks and AS numbers to Regional Internet Registries (RIRs).

PGP Message Encryption

A hybrid cryptosystem that encrypts plaintext messages using an ephemeral symmetric session key, which is subsequently encrypted using the recipient's public key. The recipient decrypts the session key using their private key.

PGP Digital Signature

A verification mechanism wherein the sender signs a cryptographic digest of a message using their private key; recipients verify authenticity and integrity using the sender's public key.

Public PGP Key Forensic Value

Can reveal a unique key fingerprint, creation metadata, and associated claimed user identification or email strings that warrant corroborating investigation.

IPv4 Header Length (IHL) and Total Length

IHL denotes the length of the IPv4 header in $32$-bit words, while Total Length specifies the complete packet length (header plus encapsulated payload) in bytes.

IPv4 DSCP and ECN

DSCP (Differentiated Services Code Point) classifies traffic for Quality of Service handling; ECN (Explicit Congestion Notification) signals network congestion without dropping packets.

IPv4 Fragmentation Fields

Identification, Flags (DF/MF), and Fragment Offset fields used by receiving network stacks to track, order, and reassemble fragmented IP packets.

IPv4 Time to Live (TTL)

An $8$-bit counter field decremented by each intermediate forwarding router; once it decrements to zero, the packet is discarded to prevent infinite routing loops.

Subnet Mask / CIDR Prefix

A bitmask identifying the network portion of an IP address. Bitwise AND calculation of an IPv4 address and its subnet mask produces the base network address.

192.168.1.130/26 Subnet Boundaries

Network address: 192.168.1.128; Broadcast address: 192.168.1.191; Usable host IP range: 192.168.1.129 through 192.168.1.190.

Usable Hosts in a Standard IPv4 /26 Subnet

$62$ usable host addresses ($2^6 - 2 = 64 - 2$), accounting for the deduction of the network and broadcast addresses.

Historical IPv4 Class First-Octet Ranges

Class A: $1\text{--}126$; Class B: $128\text{--}191$; Class C: $192\text{--}223$; Class D (Multicast): $224\text{--}239$; Class E (Reserved/Experimental): $240\text{--}255$.

RFC 1918 Private IPv4 Ranges

Three non-routable address reservations: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.

Special IPv4 Addresses (127.0.0.1, 169.254.0.0/16, 255.255.255.255)

Represent the local host loopback interface, IPv4 link-local (APIPA) auto-assignment space, and the limited subnet broadcast address, respectively.

NAT vs. PAT

Network Address Translation (NAT) modifies IP addresses between networks; Port Address Translation (PAT) additionally multiplexes transport-layer source ports, allowing multiple internal hosts to share one public IP address.

PAT Session Attribution

The forensic procedure of matching an external public IP, mapped external port, protocol, and exact timestamp to stateful NAT/firewall translation logs, followed by correlating the revealed internal IP to DHCP leases or host artifacts.

MAC Address

A Layer $2$ physical interface identifier that is easily spoofed or randomized and is normally stripped when traffic crosses Layer $3$ routing boundaries.

Network Five-Tuple

The core metadata set identifying a network connection: Source IP, Destination IP, Source Port, Destination Port, and Transport Protocol.

Flow Metadata vs. Full Packet Capture

Flow records summarize conversation sessions (recording endpoints, timestamps, and packet/byte counts), whereas full packet capture preserves complete raw headers and payload bytes visible at the tap.

Default Administrative and Cleartext Ports

FTP Control: $21$; FTP Active Data: $20$; SSH: $22$; Telnet: $23$.

Default Mail Ports

SMTP: $25$; POP3: $110$; IMAP: $143$.

Default Web and Remote Desktop Ports

HTTP: $80$; HTTPS: $443$; RDP: $3389$; IRC example: $6667$.

IDS vs. IPS

An Intrusion Detection System (IDS) alerts administrators upon observing suspicious activity; an inline Intrusion Prevention System (IPS) actively blocks, drops, or terminates offending sessions in real time.

Signature-Based vs. Anomaly-Based IDS

Signature-based detection compares traffic patterns against specific known attack strings/rules; anomaly-based detection evaluates traffic variations against established statistical baselines of normal behavior.

Stateless vs. Stateful Firewalls

Stateless firewalls filter individual packets against static rule sets in isolation; stateful firewalls track the full lifecycle, sequence numbers, and state transitions of active connections.

OSI Layer 1 (Physical Layer)

Moves raw, unstructured bitstreams over physical transmission media such as copper cabling, optical fiber, or radio frequencies.

OSI Layer 2 (Data Link Layer)

Packages data into frames and coordinates local link transfers using physical addressing such as Ethernet MAC addresses; typical home of network switches.

OSI Layer 3 (Network Layer)

Handles logical packet addressing, network routing, and path determination across subnets; home to IP and ICMP.

OSI Layer 4 (Transport Layer)

Coordinates end-to-end communication sessions and data transfer reliability using transport endpoints and port assignments; home to TCP and UDP.

OSI Layer 5 (Session Layer)

Establishes, manages, synchronizes, and terminates interactive dialogues and sessions between communicating applications.

OSI Layer 6 (Presentation Layer)

Translates, formats, serializes, compresses, and encrypts data structures to present a standardized format across disparate systems.

OSI Layer 7 (Application Layer)

Exposes network services and interfaces directly to end-user software applications; encompasses protocols like HTTP, DNS, and SMTP.

TCP Three-Way Handshake

The standard connection initialization sequence: Initiator dispatches SYN, Responder replies with SYN-ACK, and Initiator confirms with ACK.

SYN Flood

A denial-of-service attack transmitting an onslaught of spoofed TCP SYN requests without returning ACKs, filling connection state queues and starving server resources.

PBX / IP-PBX Toll Fraud Evidence

Evidentiary data including call detail records (CDRs), carrier invoices, extension authentication logs, and call-forwarding configuration modifications indicating unauthorized routing to premium-rate numbers.

SIP and SDP

SIP (Session Initiation Protocol) is an application-layer signaling protocol that sets up, modifies, and tears down multimedia sessions; SDP (Session Description Protocol) defines the media parameters and streaming ports for those sessions.

STUN

Session Traversal Utilities for NAT (historically Simple Traversal of UDP Through NATs); assists real-time VoIP/SIP endpoints in discovering their public mapped NAT address and port.

SOC vs. Incident Response (IR) Team

A Security Operations Center (SOC) continuously monitors telemetry and triages inbound alerts; the Incident Response (IR) team scopes, contains, forensically investigates, and remediates confirmed security breaches.

STIX and TAXII

STIX (Structured Threat Information Expression) provides a structured language and data model to represent threat intelligence; TAXII (Trusted Automated Exchange of Intelligence Information) is the transport protocol used to exchange STIX data.

Advanced Persistent Threat (APT)

A sophisticated, highly resourced adversary or coordinated campaign conducting stealthy, continuous operations over extended periods, often aimed at espionage or intellectual property theft.

APT10 / Operation Cloud Hopper

A prominent cyber espionage campaign targeting managed service providers (MSPs) as an infiltration vector into customer networks; cited utilizing tools such as Poison Ivy, PlugX, RedLeaves, and QuasarRAT.