Network forensics
Reconstruct communication using captures, flow records, and service logs.
The idea
Network forensics examines evidence of communication. Sources include packet captures, flow records, DNS, firewall logs, and application records. Each observes a different part of activity. Encrypted traffic, capture loss, asymmetric routes, and collection limits can reduce visibility. Record the capture point and scope before interpreting absence or direction. A useful analysis links network observations to systems, identities, and the investigative question.
In practice
A capture shows a connection to an external service, while application records establish which account requested a file. The combined evidence is stronger than either source alone.
A common misunderstanding
A flow record generally does not preserve the application payload or prove the content of a transfer.
Check your understanding
Why document the capture location?
Think it through: It determines which traffic could be observed and which paths may be invisible.
Visibility depends on the observation point
Network evidence describes communication as seen by a particular sensor or service. A packet capture may contain detailed protocol fields, while flow records summarize endpoints, timing, and volume. DNS, proxy, firewall, and application logs add different context. Combining them can answer questions that no single source resolves. First identify what each source actually observes and what it omits.
Encryption, asymmetric routing, capture loss, network address translation, and retention all affect interpretation. A sensor outside a proxy may see the proxy's address rather than the original device. A flow record showing a connection does not necessarily reveal the application content or the human responsible. Document these boundaries before making a strong attribution claim.
A fictional unusual upload
An academy notices a large outbound transfer. Investigators compare firewall summaries with proxy records and endpoint activity. They find that the traffic came through a shared gateway, so they need time-correlated internal records to identify the originating device. A large transfer alone could be a legitimate backup or course-video upload.
The team preserves the relevant time window and evaluates the destination, initiating process, user context, and expected business activity. If the payload is encrypted, the report should say what metadata supports the finding and what content remains unknown. Do not describe an observed byte count as proof that particular confidential files were transferred.
Build a bounded finding
Use a provided training capture and fictional firewall log. Identify a conversation, record its endpoints and time context, and state which source supports each fact. Write one conclusion you can defend and one question the evidence cannot answer. This develops confidence in evidence while avoiding the common mistake of treating network visibility as a complete record of everything that happened.
Keep exploring
References & further reading
Original explanations, with primary references for deeper study.
Wireshark User’s Guide