Fundamentals of Network Forensics and Log Analysis

Author

K19G

Updated

October 31, 2026

Fundamentals of Network Forensics and Log Analysis

Digital forensics across network boundaries requires collecting, preserving, and reconstructing transient evidence. Unlike host-based forensics, where disk sectors and memory pages persist until overwritten or powered off, network packets exist only as electromagnetic pulses in copper or photonic bursts in fiber. If a network event is not captured at wire speed at the exact microsecond of transit, that evidence is permanently lost.

This chapter establishes the core architectural workflows, data sources, and evidentiary protocols for full packet capture (PCAP), flow telemetry (NetFlow/IPFIX/sFlow), Deep Packet Inspection (DPI), and log parsing.

┌────────────────────────────────────────────────────────────────────────┐
│                        Physical / Virtual Fabric                       │
└───────┬───────────────────────────┬────────────────────────────┬───────┘
        │ Optical TAP / SPAN        │ eBPF / Socket Mirror       │ Host Logs
        ▼                           ▼                            ▼
┌──────────────────┐        ┌──────────────────┐        ┌────────────────┐
│ Full Packet (L2) │        │ Flow Telemetry   │        │ Event Streams  │
│ (PCAP / Arkime)  │        │ (IPFIX / NetFlow)│        │ (Syslog, Auth) │
└───────┬──────────┘        └───────┬──────────┘        └───────┬────────┘
        │                           │                           │
        └───────────────────┬───────┴───────────────────────────┘
                            ▼
              ┌───────────────────────────┐
              │ Normalization & Indexing  │
              │ (DPI, ECS / OCSF Parsing) │
              └─────────────┬─────────────┘
                            ▼
              ┌───────────────────────────┐
              │ Cryptographic Chain of    │
              │ Custody & RFC 3227 Vault  │
              └───────────────────────────┘

The Triad of Network Evidence

Network forensic evidence divides into three distinct telemetry classes, each trading storage volume for analytical fidelity:

Telemetry Class Data Primitives Capture Technology Fidelity Storage Burden
Full Packet Capture (FPC) Raw L2–L7 frame bytes, inter-packet arrival times, payloads Hardware TAPs, SPAN/Mirror ports, PF_RING, DPDK, AF_PACKET Maximum (Byte-exact payload recovery) Extreme (~10–100 TB / day per 10Gbps link)
Flow Telemetry 5-tuple, byte/packet counters, timestamps, TCP flags, ASNs NetFlow v9, IPFIX (RFC 7011), sFlow, eBPF sockops Moderate (Statistical session metadata) Low (~0.1–1% of raw packet volume)
Protocol Event Logs Parsed transactions (DNS requests, HTTP headers, TLS handshakes) Zeek (Bro), Suricata EVE JSON, Snort 3, AWS VPC Flow High (Application semantics without raw bulk data) Moderate (~2–5% of raw packet volume)

1. Full Packet Capture (PCAP)

Full packet capture records every frame transmitted across a tap or span port.

  • Wire-Speed Ingestion: Standard Linux kernel socket layers (AF_INET) drop packets under gigabit loads due to interrupt handling and context switches. Production forensic capture engines utilize zero-copy ring buffers (AF_PACKET with TPACKET_V3), PF_RING ZC, or user-space poll-mode drivers via DPDK.

  • BPF Filtering: Forensic capture often employs Berkeley Packet Filters (BPF) to drop bulk high-volume, low-forensic-value streams (e.g., internal video backups or NFS data blocks) while capturing all control and external traffic:

    # Capture all traffic excluding high-bandwidth internal backup cluster
tcpdump -i eth1 -s 0 -w /var/forensics/capture_%Y%m%d_%H%M%S.pcap \
  -G 3600 'not (net 10.200.0.0/16 and port 2049)'

2. Flow Telemetry (IPFIX / NetFlow)

Flow analysis condenses bidirectional packet sequences sharing a common 5-tuple: \[\text{Flow} = (\text{SrcIP}, \text{DstIP}, \text{SrcPort}, \text{DstPort}, \text{L4 Protocol})\]

Flow records track connection start time, duration, packet count, byte count, cumulative TCP flags (SYN, ACK, FIN, RST, PSH, URG), and routing metadata (BGP ASNs, ingress/egress interfaces). Flow telemetry provides macroscopic behavioral visibility: - Detecting data exfiltration via abnormally skewed byte ratios: \[\text{Ratio}_{\text{exfil}} = \frac{\text{Bytes}_{\text{out}}}{\text{Bytes}_{\text{in}}} \gg 1.0\] - Identifying port scanning or horizontal network discovery through short-duration, zero-data flows with high failure or RST ratios.

3. Deep Packet Inspection (DPI) & Protocol Extraction

DPI engines (notably Zeek and Suricata) disassemble application protocols in real time, emitting structured metadata without storing multi-terabyte payload streams:

[ Raw Packets ] ───> [ Reassemble TCP Streams ] ───> [ Protocol Analyzers ]
                                                              │
                                                              ├──> dns.log (QNAME, RR, TTL)
                                                              ├──> http.log (URI, Host, Method)
                                                              ├──> ssl.log (JA3/JA4, SNI, Cert)
                                                              └──> conn.log (State, Duration)

For instance, the JA3 / JA4 cryptographic fingerprint hashes the exact configuration of TLS Client Hello extensions, supported ciphers, and elliptic curve algorithms: \[\text{JA3} = \text{MD5}(\text{TLSVersion, Ciphers, Extensions, EllipticCurves, EllipticCurvePointFormats})\] Adversary tools (e.g., Cobalt Strike, Sliver, Python scripts) exhibit static JA3/JA4 fingerprints that diverge sharply from standard enterprise web browsers, enabling immediate behavioral classification even inside fully encrypted TLS tunnels.

Evidence Preservation and Chain of Custody

Digital forensic evidence must remain legally defensible. If an intrusion leads to criminal prosecution, civil litigation, or regulatory disclosure under strict evidentiary standards (e.g., Federal Rules of Evidence in the US, ISO/IEC 27037 globally), the integrity of network evidence is scrutinized.

Order of Volatility (RFC 3227)

When collecting evidence during an active network incident, investigators must adhere to the standard order of volatility:

[ Highest Volatility ]
  1. CPU registers, cache, pipeline state
  2. Routing tables, ARP cache, active connection state tables, kernel memory
  3. Temporary file systems, ephemeral ring buffers (/dev/shm, /tmp)
  4. Non-volatile storage (disks, SSDs, local logs)
  5. Network device configurations and out-of-band capture buffers
  6. Archival backups and immutable remote WORM storage
[ Lowest Volatility ]

Cryptographic Evidence Integrity

Raw PCAP files and parsed logs must be hashed immediately upon capture and sealed:

# Generate deterministic SHA-256 evidence checksum immediately post-capture
sha256sum capture_20261031_1400.pcap > capture_20261031_1400.pcap.sha256

# Write-protect capture repository
chmod 0440 capture_20261031_1400.pcap

# Generate detached GPG signature for non-repudiation
gpg --detach-sign --armor capture_20261031_1400.pcap

Timestamp Synchronization and Microsecond Accuracy

In multi-node network forensics, clock drift invalidates event correlation. If a packet trace on firewall \(A\) is skewed by 350 ms relative to web server \(B\), causality analysis breaks (e.g., an outbound command appears to arrive before the inbound trigger).

  • Precision Time Protocol (PTP - IEEE 1588v2): Required for packet capture appliances, delivering sub-microsecond timestamping hardware offloaded directly on the NIC (Network Interface Card).
  • Network Time Security (NTS / NTPv4): Required for all distributed log collectors to prevent malicious time spoofing or replay attacks.

Practical Log Parsing and Normalization

Raw syslogs vary across vendors. Behavioral analysis requires normalizing divergent syntax into common schemas such as Elastic Common Schema (ECS) or Open Cybersecurity Schema Framework (OCSF).

Parsing Cisco ASA Syslog to ECS JSON

Raw syslog line:

%ASA-6-302013: Built inbound TCP connection 98124403 for outside:198.51.100.22/54231 (198.51.100.22/54231) to inside:10.0.1.15/443 (10.0.1.15/443)

Normalized ECS output:

{
  "@timestamp": "2026-10-31T14:22:15.104Z",
  "event": {
    "category": ["network"],
    "action": "connection-started",
    "dataset": "cisco_asa.firewall",
    "id": "98124403"
  },
  "source": {
    "ip": "198.51.100.22",
    "port": 54231,
    "zone": "outside"
  },
  "destination": {
    "ip": "10.0.1.15",
    "port": 443,
    "zone": "inside"
  },
  "network": {
    "transport": "tcp",
    "direction": "inbound"
  }
}

Once normalized, behavioral pipelines evaluate connection rates, destination port distributions, and temporal cadence across millions of heterogeneous network events simultaneously.

Chapter Summary

  • Network evidence spans raw PCAP, statistical IPFIX/NetFlow, and semantic protocol events (Zeek/Suricata).
  • High-speed packet capture demands zero-copy architectures (AF_PACKET TPACKET_V3, DPDK) to prevent frame loss during packet bursts.
  • Deep Packet Inspection extracts actionable behavioral metadata (such as JA3/JA4 TLS fingerprints) from encrypted channels.
  • Adhering to RFC 3227 order of volatility, hardware-assisted timestamp synchronization (PTP), and cryptographic hashing ensures evidence is legally defensible.