Skip to content

Understanding Network Forensics

Network forensics uses packets and network records to reconstruct communications, protocols, transferred content, and observable behaviour.

What you will learn

By the end, you should be able to distinguish packet content from metadata, explain capture limitations, and follow an evidence-led filtering workflow.

What is network forensics?

Core concept

A packet capture records traffic visible at a capture point. Session and metadata tools organise communications into higher-level records. Neither view automatically reveals activity that was not routed through the sensor, retained, or decryptable.

PacketsFlowsProtocolsEndpointsTransferred objects

Keep in mind: An IP address identifies a network endpoint in context, not necessarily a person. Account, device, NAT, VPN, DHCP, and time evidence may be required.

01PCAPA file containing captured packet data02Five-tupleSource and destination addresses, ports, and protocol03StreamRelated packets reconstructed as a conversation

Evidence views

PacketsHeaders and available payload bytes
FlowsSummaries of endpoints, ports, volume, and timing
Protocol metadataParsed fields such as DNS names or HTTP requests
AlertsRule matches that require analyst validation

Why it matters

Reconstruct conversations

Packet sequence and streams reveal how endpoints communicated.

Resolve infrastructure

DNS, TLS, and application protocols can add domain and service context.

Recover transferred content

Unencrypted or otherwise available objects may be exported and hashed.

Correlate activity

Network timestamps can be compared with endpoint, identity, and application evidence.

How network analysis works

  1. ValidateRecord capture point, time, duration, interfaces, filtering, loss, and integrity.
  2. SurveyReview endpoints, protocols, volume, conversations, and time distribution.
  3. FilterNarrow by question using addresses, ports, protocols, names, indicators, and time.
  4. ReconstructFollow streams, inspect protocol fields, and export relevant objects safely.
  5. CorrelateConnect network observations with host, identity, process, and file evidence.

Choose the next step

ScenarioA PCAP shows repeated connections from an internal IP to an unfamiliar domain. What should you do next?

Filter from a question

  1. 1SurveyUnderstand capture scope and dominant activity.
  2. 2FilterNarrow to relevant endpoints, protocols, and time.
  3. 3ReconstructFollow conversations and inspect context.
  4. 4CorrelateConnect network and endpoint evidence.

Network-forensics tools in SUSA

Packet analysis

Wireshark

Filter packets, inspect protocols, follow streams, and export objects.

Session analysis

RSA NetWitness Investigator

Explore network sessions and metadata for investigative leads.

Continue learning