View source for Network forensics

{{ForensicScience|digital|image=NetworkTopologies.svg}}

'''Network forensics''' is a sub-branch of [[Digital forensics|digital forensics]] relating to the monitoring and analysis of [[Computer network|computer network]] traffic for the purposes of information gathering, legal evidence, or intrusion detection.<ref>Gary Palmer, A Road Map for Digital Forensic Research, Report from DFRWS 2001, First Digital Forensic Research Workshop, Utica, New York, August 7 – 8, 2001,  Page(s) 27–30</ref> Unlike other areas of digital forensics, network investigations deal with volatile and dynamic information. Network traffic is transmitted and then lost, so network forensics is often a pro-active investigation.<ref name="casey">{{cite book|last=Casey|first=Eoghan|title=Digital Evidence and Computer Crime, Second Edition|year=2004|publisher=Elsevier|isbn=0-12-163104-4|url=https://books.google.com/books?id=Xo8GMt_AbQsC&q=Digital%20Evidence%20and%20Computer%20Crime,%20Second%20Edition}}</ref>

Network forensics generally has two uses. The first, relating to security, involves monitoring a network for anomalous traffic and identifying intrusions. An attacker might be able to erase all log files on a compromised host; network-based evidence might therefore be the only evidence available for forensic analysis.<ref>Erik Hjelmvik, Passive Network Security Analysis with NetworkMiner http://www.forensicfocus.com/passive-network-security-analysis-networkminer {{Webarchive|url=https://web.archive.org/web/20120223222727/http://www.forensicfocus.com/passive-network-security-analysis-networkminer |date=2012-02-23 }}</ref> The second form relates to law enforcement. In this case analysis of captured network traffic can include tasks such as reassembling transferred files, searching for keywords and parsing human communication such as emails or chat sessions.

Two systems are commonly used to collect network data; a brute force "catch it as you can" and a more intelligent "stop look listen" method.

==Overview==

Network forensics is a comparatively new field of forensic science. The growing popularity of the Internet in homes means that computing has become network-centric and data is now available outside of disk-based [[Digital evidence|digital evidence]]. Network forensics can be performed as a standalone investigation or alongside a [[Computer forensics|computer forensics]] analysis (where it is often used to reveal links between digital devices or reconstruct how a crime was committed).<ref name="casey" />

Marcus Ranum is credited with defining Network forensics as "the capture, recording, and analysis of network events in order to discover the source of security attacks or other problem incidents".<ref>Marcus Ranum, Network Flight Recorder, http://www.ranum.com</ref>

Compared to computer forensics, where evidence is usually preserved on disk, network data is more volatile and unpredictable. Investigators often only have material to examine if packet filters, firewalls, and intrusion detection systems were set up to anticipate breaches of security.<ref name="casey" />

Systems used to collect network data for forensics use usually come in two forms:<ref>Simson Garfinkel, Network Forensics: Tapping the Internet http://www.oreillynet.com/pub/a/network/2002/04/26/nettap.html</ref>
*"Catch-it-as-you-can" – This is where all packets passing through a certain traffic point are captured and written to storage with analysis being done subsequently in batch mode. This approach requires large amounts of storage.
*"Stop, look and listen" – This is where each packet is analyzed in a rudimentary way in memory and only certain information saved for future analysis. This approach requires a faster [[Central processing unit|processor]] to keep up with incoming traffic.

==Types==

===Ethernet===
[[File:Wireshark screenshot.png|thumb|[[Software:Wireshark|Wireshark]], a common tool used to monitor and record network traffic]]

Apt all data on this layer  allows the user to filter for different events. With these tools, website pages, email attachments, and other network traffic can be reconstructed only if they are transmitted or received unencrypted. An advantage of collecting this data is that it is directly connected to a host. If, for example the IP address or the [[MAC address]] of a host at a certain time is known, all data sent to or from this IP or MAC address can be filtered.

To establish the connection between IP and MAC address, it is useful to take a closer look at auxiliary network protocols. The Address Resolution Protocol (ARP) tables list the MAC addresses with the corresponding IP addresses.

To collect data on this layer, the network interface card (NIC) of a host can be put into "[[Software:Promiscuous mode|promiscuous mode]]". In so doing, all traffic will be passed to the CPU, not only the traffic meant for the host.

However, if an intruder or attacker is aware that his connection might be eavesdropped, he might use encryption to secure his connection. It is almost impossible nowadays to break encryption but the fact that a suspect's connection to another host is encrypted all the time might indicate that the other host is an accomplice of the suspect.

===TCP/IP===

On the network layer the [[Internet Protocol]] (IP) is responsible for directing the packets generated by [[Transmission Control Protocol|TCP]] through the network (e.g., the Internet) by adding source and destination information which can be interpreted by routers all over the network. Cellular digital packet networks, like GPRS, use similar protocols like IP, so the methods described for IP work with them as well.

For the correct routing, every intermediate [[Engineering:Router (computing)|router]] must have a routing table to know where to send the packet next.
These routing tables are one of the best sources of information if investigating a digital crime and trying to track down an attacker. To do this, it is necessary to follow the packets of the attacker, reverse the sending route and find the computer the packet came from (i.e., the attacker).

=== Encrypted Traffic Analytics ===
Given the proliferation of [[Transport Layer Security|TLS]] encryption on the internet, as of April 2021 it is estimated that half of all malware uses TLS to evade detection.<ref>{{Cite web|last=Gallagher|first=Sean|date=2021-04-21|title=Nearly half of malware now use TLS to conceal communications|url=https://news.sophos.com/en-us/2021/04/21/nearly-half-of-malware-now-use-tls-to-conceal-communications/|access-date=2021-04-29|website=Sophos News|language=en-US}}</ref> Encrypted [[Traffic analysis|traffic analysis]] inspects traffic to identify encrypted traffic coming from malware and other threats by detecting suspicious combinations of TLS characteristics, usually to uncommon [https://www.arin.net/resources/guide/asn/ networks] or servers.<ref>{{Citation|title=Encrypted Traffic Analysis (Part 1): Detect, Don't Decrypt|url=https://www.youtube.com/watch?v=DhJ_h4fa8PA |archive-url=https://ghostarchive.org/varchive/youtube/20211220/DhJ_h4fa8PA |archive-date=2021-12-20 |url-status=live|language=en|access-date=2021-04-29}}{{cbignore}}</ref> Another approach to encrypted traffic analysis uses a generated database of [https://engineering.salesforce.com/tls-fingerprinting-with-ja3-and-ja3s-247362855967?gi=3d60b9094e71 fingerprints], although these techniques have been criticized as being easily bypassed by hackers<ref>{{Cite web|last=Rinaldi|first=Matthew|date=2020-11-03|title=Impersonating JA3 Fingerprints|url=https://medium.com/cu-cyber/impersonating-ja3-fingerprints-b9f555880e42|access-date=2021-04-29|website=Medium|language=en}}</ref><ref>{{Cite web|date=2020-04-16|title=JA3/S Signatures and How to Avoid Them|url=https://www.bc-security.org/post/ja3-s-signatures-and-how-to-avoid-them/|access-date=2021-04-29|website=BC Security|language=en-US}}</ref> and inaccurate.

===The Internet===
The internet can be a rich source of digital evidence including web browsing, email, newsgroup, synchronous chat and [[Peer-to-peer|peer-to-peer]] traffic. For example, web server logs can be used to show when (or if) a suspect accessed information related to criminal activity. Email accounts can often contain useful evidence; but email headers are easily faked and, so, network forensics may be used to prove the exact origin of incriminating material. Network forensics can also be used in order to find out who is using a particular computer<ref>[http://www.netresec.com/?page=Blog&month=2011-01&post=Facebook-SSL-and-Network-Forensics "Facebook, SSL and Network Forensics", NETRESEC Network Security Blog, 2011]</ref> by extracting user account information from the network traffic.

== Wireless forensics ==
'''Wireless forensics''' is a sub-discipline of network forensics. The main goal of wireless forensics is to provide the methodology and tools required to collect and analyze (wireless) [[Network traffic measurement|network traffic]] that can be presented as valid digital evidence in a court of law. The evidence collected can correspond to plain data or, with the broad usage of Voice-over-IP (VoIP) technologies, especially over wireless, can include voice conversations.

Analysis of wireless network traffic is similar to that on wired networks, however there may be the added consideration of wireless [[Wireless security|security measures]].

==References==
<references/>

==External links==
*[https://martinazembjakova.github.io/Network-forensic-tools-taxonomy Overview of network forensic tools and datasets (2021)]
*[https://web.archive.org/web/20100617012504/http://www.forensicswiki.org/wiki/Tools:Network_Forensics Forensics Wiki (2010)]
{{Digital forensics}}

{{DEFAULTSORT:Network Forensics}}
[[Category:Computer networking]]
[[Category:Digital forensics]]

{{Sourceattribution|Network forensics}}