Network Forensics
Network forensics is a sub-branch of digital forensics relating to the monitoring and analysis of computer network traffic for the purposes of information gathering, legal evidence, or intrusion detection. Unlike other areas of digital forensics, network investigations deal with volatile and dynamic information. Network traffic is transmitted and then lost, so network forensics is often a pro-active investigation.
Network forensics generally has two uses. The first, relating to security, involves monitoring a network for anomalous traffic and identifying intrusions. An attacker might be able to erase all log files on a compromised host; network-based evidence might therefore be the only evidence available for forensic analysis. The second form relates to law enforcement. In this case analysis of captured network traffic can include tasks such as reassembling transferred files, searching for keywords and parsing human communication such as emails or chat sessions.
Two systems are commonly used to collect network data; a brute force "catch it as you can" and a more intelligent "stop look listen" method.
Network forensics is a comparatively new field of forensic science. The growing popularity of the Internet in homes means that computing has become network-centric and data is now available outside of disk-based digital evidence. Network forensics can be performed as a standalone investigation or alongside a computer forensics analysis (where it is often used to reveal links between digital devices or reconstruct how a crime was committed).
Marcus Ranum is credited with defining Network forensics as "the capture, recording, and analysis of network events in order to discover the source of security attacks or other problem incidents".
Compared to computer forensics, where evidence is usually preserved on disk, network data is more volatile and unpredictable. Investigators often only have material to examine if packet filters, firewalls, and intrusion detection systems were set up to anticipate breaches of security.
Systems used to collect network data for forensics use usually come in two forms:
- "Catch-it-as-you-can" – This is where all packets passing through a certain traffic point are captured and written to storage with analysis being done subsequently in batch mode. This approach requires large amounts of storage.
- "Stop, look and listen" – This is where each packet is analyzed in a rudimentary way in memory and only certain information saved for future analysis. This approach requires a faster processor to keep up with incoming traffic.
The most popular products in category Network Forensics All category products
Suppliers Network Forensics
Vendors Network Forensics
- AUT
- AUS
- BEL
- CAN
- CHE
- CHN
- DEU
- FRA
- GBR
- IRL
- ISR
- IND
- ITA
- JPN
- LIE
- LKA
- LUX
- MYS
- NPL
- NZL
- PRT
- SGP
- USA
F.A.Q. about Network Forensics
Why is network forensics important?
Network forensics is important because so many common attacks entail some type of misuse of network resources.
What are the different ways in which the network can be attacked?
Attacks typically target availability confidentiality and integrity. Loss of any one of these items constitutes a security breach.
Where is the best place to search for information?
Information can be found by either doing a live analysis of the network, analyzing IDS information, or examining logs that can be found in routers and servers.
How does a forensic analyst know how deeply to look for information?
Some amount of information can be derived from looking at the skill level of the attacker. Attackers with little skill are much less likely to use advanced hiding techniques.
Materials
Network Forensics
https://www.cfila.com/network-forensics