CLASS NOTES Network Forensics

Network forensics involves the monitoring and analysis of computer network traffic for the purposes of information gathering, legal evidence, or intrusion detection.
The primary goal is to capture, record, and analyze network events to identify security incidents and conduct forensic investigations.

Fundamentals of Network Forensics
- Definition and importance of network forensics in modern security landscapes.
- Log Analysis: Crucial for examining past events and determining breaches or anomalies.
- Event Correlation: Linking related events to identify patterns that could indicate larger security issues.
- Indicators of Compromise (IOCs): Specific artifacts observed on a network that suggest a security breach.
- Network Traffic Investigation: Analyzing data traversing a network to detect anomalies or threats.

Every organization operates within some form of network architecture, requiring knowledge of how to capture and analyze network events.
Techniques used include gathering logs, identifying the source and paths of suspicious events, understanding attackers' tactics, techniques, and procedures (TTPs), and utilizing various examination methods including:
- Post-Mortem Analysis: Reviewing data after an incident.
- Real-Time Analysis: Monitoring events as they occur to catch ongoing attacks.

Wireless Network Attacks: Occurs in both wired and wireless environments, with specific techniques such as:
- Sniffing: Observing traffic to collect information.
- IP Spoofing: Masquerading as another device.
- Denial of Service (DoS): Overwhelming a network resource.
- Man-in-the-Middle (MitM): Intercepting communications between two parties.
Enumeration: Gathering additional information about devices and services, including:
- Application versions, service information, and network configurations.
Password Attacks: Attempts to retrieve or bypass passwords.
Software Exploits: Such as buffer overflow attacks which misuse memory allocation.

IOCs serve as digital forensic artifacts or clues that help identify ongoing or past incidents on the network and can include:
- Unusual Outbound Network Traffic: For instance, traffic leaving at odd hours or to unusual locations.
- URLs and User-Agent Strings: Specific web addresses accessed or the browsers used to identify user activity.
- Anomalous Login Events: Multiple login attempts to the same file without success.
- Traffic on Unusual Ports: Listening for traffic on atypical ports or unusual protocols.

Logs: A primary source for forensic investigation, could include application logs, network device logs, security logs, and DHCP server logs.

Full Content Data: Actual packets captured (using tools like Wireshark).
Session Data: Summary of transmissions between devices, including timestamps and amounts of data exchanged.
Alert Data: Logs from Intrusion Detection Systems (IDS) or Intrusion Prevention Systems (IPS), indicating potential threats.
Statistical Data: Summaries that provide insights into traffic flows, average packet sizes, and network performance metrics.

Same Platform Correlation: Events on the same operating system.
Cross-Platform Correlation: Linking events across different systems or vendors, necessitating standardized logs.
Event Aggregation and Analysis: Collecting similar events over time to identify trends or emerging threats.

Utilizing log management platforms allows for:
- Aggregation: Collecting logs from multiple sources.
- Normalization: Ensuring that different logs can be analyzed in a uniform format.
- Event Filtering: Reducing the noise and focusing on the most pertinent information.

Firewalls: Primary point of entry into the network, logging all passed packets and access attempts.
Intrusion Detection Systems (IDS): Monitor packets for known threats and suspicious patterns.
Router Logs: Detail the path taken by packets, including source, destination, and protocols used.
Honeypots: Set up to attract attackers, logging their methods and techniques while keeping the primary network secure.

Traffic Monitoring Methodologies:
- Use tools like sniffers that can operate in promiscuous mode to capture all data passing through a network interface.
- Wireshark is a powerful GUI tool used for network traffic analysis, providing detailed packet information.

TCP/IP Attack Techniques: Understanding methods like TCP SYN Flood, where packets are sent to overwhelm a resource, and observing resultant network behavior.
Utilizing command-line tools such as tcpdump to analyze specific aspects of traffic flows for anomalies indicating potential attacks.

Real-world examples include examining timestamps of unusual activity, enabling proactive defenses in future incidents, and formalizing responses based on logged data.

Network forensics merges traditional investigation techniques with modern technology to better understand and react to cyber threats. Learning to leverage different log data combined with timely analysis will empower organizations to create robust defense mechanisms against malicious activities.

Next Steps: Further discussions on web attacks and their implications will follow in subsequent modules.