A security alert says a server contacted an unfamiliar IP address at 2 a.m. That alone doesn’t explain much. It doesn’t say what was sent, whether the connection was harmless, or whether other systems did the same thing. Answering those questions takes network evidence, and collecting and reading that evidence takes the right tools.
Network forensics is the process of capturing and analyzing network traffic, packets, sessions and logs to investigate security incidents and reconstruct attacker activity. Where computer forensics looks at a single device, network forensics looks at the communication between devices. The tools used for it fall into five main groups, and most teams end up using a combination.
What Network Forensics Covers
Network forensics means capturing and analyzing traffic, packets, sessions and logs to work out what happened during a security incident. Computer forensics examines one machine at a time. This examines the conversations between machines, which is where lateral movement and data theft show up.
That’s also why it pairs well with endpoint forensics. The endpoint tells you malware ran. The network tells you where that machine went next.
Packet Capture with tcpdump and Wireshark
Capture comes first, because you can’t analyze traffic nobody recorded.
tcpdump runs from the command line and is available for Linux. Something like tcpdump -i eth0 -w capture.pcap on a suspect server writes everything it sees to a file. It can run over SSH when you can’t install anything with a GUI. On production systems, plan capture permissions and disk space before starting.
Wireshark is where most analysts then open that file. Display filters let you cut a huge capture down to one host or one protocol, and Follow TCP Stream stitches a session back into something readable. A lot of analysts spend more hours in Wireshark than in any other single tool.
Both have the same limit. They work well on a single link for a few hours. Ask either one to cover a whole data center for three weeks and you’ll hit storage and search problems quickly.
PCAP Analysis with NetworkMiner and Xplico
A capture file is just bytes until something interprets it.
NetworkMiner, from Netresec, pulls files, images, host details and cleartext credentials out of a capture. If someone downloaded an executable over HTTP, you could often recover the actual file and hash it. Xplico is open source and reconstructs web pages, email and VoIP calls from packets, so you see roughly what the user saw instead of headers and hex.
The second one helps most when you have to explain findings to a lawyer or a manager. Showing a reconstructed email lands better than showing a packet list.
Flow Data and What It Leaves Out
Full packets are expensive to keep. Flow records are cheap. A flow record notes the source, destination, ports, protocol, start time, duration and byte count, and drops the payload completely.
SolarWinds and ManageEngine both collect and report on flow data. It’s useful for spotting patterns, like a database server that never talks to the internet suddenly pushing data to an external IP. You’ll see the volume and the timing. You won’t see the content, so flow data usually points you at a session, and then you go find the packets for it if you kept them.
Logs and SIEM Platforms
A single network session rarely settles anything. A login failure, a new service account, a DNS lookup for a strange domain and a firewall deny might all matter, and they live in different systems.
Splunk and the ELK Stack (Elasticsearch, Logstash, Kibana) pull those sources into one searchable place. An analyst can take a timestamp from a suspicious session and check what else happened on the network in that same minute. NIST SP 800-92 covers log management practices, including what to collect and how long to keep it, and the practical lesson is dull but true. If logs rolled over before anyone looked, the investigation starts with a hole in it.
Full Packet Capture at Scale
Once traffic volumes climb and several analysts need the same data, standalone utilities get awkward. You need continuous capture, indexing, long retention and fast search.
Arkime, previously called Moloch, is an open source option that captures PCAP and indexes sessions so they can be searched. It runs well for teams comfortable managing their own storage and sensors. NetWitness is a commercial option that captures sessions, enriches them with metadata, and brings analysis and reporting into the same interface.
How the Tools Line Up in an Investigation
A typical investigation moves through a few stages, and the tools overlap them differently.
- Scope the incident and decide which network segments matter
- Preserve captures, flow records and logs, and document chain of custody
- Collect data from routers, switches, firewalls and sensors
- Examine the traffic for odd connections and indicators of compromise
- Build a timeline of how the attack started and spread
- Write it up for technical and non-technical readers
tcpdump and Wireshark mostly help with collection and examination. NetworkMiner and Xplico help during the timeline work. A SIEM helps tie in outside events. Full capture platforms touch most stages at once.
Choosing Network Forensics Tools
Start from the questions you expect to answer, not from a feature chart.
Traffic volume decides a lot. A small office can get by on tcpdump and Wireshark, while a large enterprise network can’t. Retention matters just as much. If your team usually finds out about incidents a week late, you need data that goes back a week, and ideally further.
Encryption changes what you can see. With TLS on most traffic, payloads are often unreadable, so you lean on metadata such as certificates, server names, timing and volume. Check that a tool makes those fields easy to search.
Last, look at how a tool connects to your SIEM and endpoint products. A tool that can’t share data with them adds manual steps to every case.
Where NetWitness Fits
Teams that outgrow single-purpose utilities often move to a platform that handles capture, metadata and investigation together. NetWitness is built for that, with retained network sessions that analysts can search back through when a threat turns up late. NetWitness covers the approach in more depth in its network forensics guide.
Whichever route you take, test it on your own traffic before you commit. A tool that looks great in a demo can behave very differently at your real volume.
