Network Forensics Study Notes

Core Principles of Network Forensics

• Definition: The process of capturing, recording, and analyzing network events to identify the source of security incidents or policy violations.
• Key Focus: Monitoring packets, flows, sessions, and logs to reconstruct communications as defensible Digital Evidence.
• Objectives:
  • Establish incident timelines and impact.
  • Identify attack vectors and exploited services.
  • Extract Indicators of Compromise (IOCs) such as domains, URLs, and fingerprints.

Legal and Ethical Framework

• Authorization: Written approval and defined scope are required before monitoring.
• Chain of Custody: Mandatory tracking of evidence from acquisition to presentation to ensure admissibility.
• Integrity Controls: Use of hashing, read-only storage, and $NTP$ sync for time accuracy.
• Privacy: Adherence to data protection laws; access is granted on a "need-to-know" basis, avoiding unnecessary data collection.

Network Forensics Process Model

1. Identification: Detecting the event and defining the scope (affected assets and time window).
2. Preservation: Preventing evidence loss using legal holds and stabilizing logs.
3. Collection: Acquiring data sources like $PCAP$, NetFlow, $IPFIX$, and firewall logs.
4. Examination: Normalizing data, parsing, and session reconstruction.
5. Analysis: Correlating events to identify behavior like lateral movement or exfiltration.
6. Presentation: Producing defensible reports with timelines, diagrams, and confidence levels.

Layered Forensic Analysis

• Layer $7$ (Application): Meaning of content (HTTP, DNS, SMTP) and user actions.
• Layer $4$ (Transport): $TCP/UDP$ behavior, port usage, and stream reconstruction.
• Layer $3$ (Network): $IP$ addressing, routing, $NAT$ impact, and $ICMP$ patterns.
• Layer $2$ (Data Link): $MAC$ addresses, $VLAN$ tags, and $ARP$ behaviors.

Essential Tools and Techniques

• Wireshark: Interactive packet analyzer used for deep protocol dissection and following $TCP$ streams.
• tcpdump: Command-line tool for lightweight packet capture using $BPF$ filters.
• Zeek/Suricata: Network Security Monitoring ($NSM$) for rich protocol logging and signature-based detection.
• NetworkMiner: Extracting artifacts, files, and host profiles from $PCAP$ files.
• Analysis Methods: Establishing baselines to detect anomalies, beaconing analysis for fixed-interval callbacks, and protocol validation.

Specialized Investigations

• Email Forensics: Analyzing full headers, sender infrastructure, and authentication protocols ($SPF$, $DKIM$, $DMARC$).
• Malware Traffic: Detecting command-and-control (C&C) communication, random $DGA$ domains, and unusual $TLS$ fingerprints ($JA3$).
• Data Exfiltration: Identifying unauthorized data transfer via web uploads, cloud abuse, or $DNS$ tunneling (using long subdomains and high entropy).
• Wireless Forensics: Capturing $802.11$ frames in monitor mode to detect rogue Access Points ($AP$) or handshake captures.
• Cloud Forensics: Relying on cloud-native logs ($VPC$ Flow Logs, CloudTrail) due to the absence of physical taps.

Incident Response and Reporting

• Integration: Coordination between forensics (evidence preservation) and Incident Response (containment and recovery).
• Reporting Structure: Must include an Executive Summary, Scope/Methodology, Findings with $IOC$ lists, and Appendix with raw log excerpts and hashes.
• Future Trends: Increasing reliance on metadata for encrypted traffic, $Zero\text{ }Trust$ networking, and $AI$-assisted triage workflows.