network-forensics

Network Forensics Methodology

A capture room is NOT recon→foothold→privesc. You're not attacking a host — you're reconstructing a story from traffic someone already recorded. The arc is: load → get the overview → form a hypothesis about the story → follow it → extract the answer. The /pcap command has the tshark commands; this is how to think about the capture.

0. Classify the capture task first

Read the room text — pcap rooms usually ask for one of these, and which one sets your whole path:

• Find a credential — someone logged in over a cleartext protocol.
• Recover a file / data — something was transferred (HTTP, FTP, SMB, TFTP) or exfiltrated.
• Reconstruct an attack — "what did the attacker do?" scanning, brute force, exploitation, C2.
• Answer specific questions — how many hosts, what OS, which port, what time (forensic quiz).
• Decode exfil / covert channel — data hidden in DNS, ICMP, or an odd protocol. Name the target answer (flag string? a filename? an attacker IP? a count?) so you know when you're done.

1. Load & get the overview (always — cheap and orienting)

Never start by scrolling packets. Get the shape of the capture first:

• Protocol hierarchy — what protocols are even present, and in what proportion.
• Conversations / endpoints — who talked to whom, and the heavy talkers.
• Capture duration and packet count — is this seconds or days? The overview usually tells you where the answer lives. A capture that's 90% HTTP is a web story; one with lots of DNS to one domain smells like tunneling; a burst of SYNs to many ports is a scan. Let the overview pick your branch.

2. Form the hypothesis (say it out loud)

From the overview: "the interesting thing is probably X, because Y." E.g. "creds are probably in that FTP conversation, because FTP is cleartext and there's a USER/PASS exchange." A hypothesis turns 100k packets into one thing to check.

3. Follow the story (branch by task type)

• Credentials → isolate the cleartext-auth protocol (HTTP POST, FTP, Telnet, SMTP, POP, IMAP, SNMP community strings) and read the auth exchange. Follow the specific stream.
• File recovery → export objects (HTTP/SMB/TFTP/FTP-DATA), or follow the transfer stream and save the raw bytes, then file/binwalk them. Carved file → hand to /steg if it's hiding more.
• Attack reconstruction → look at timing and volume: many SYNs = port scan; repeated logins = brute force; a shell-looking stream = exploitation/C2. Build a timeline of what happened when.
• Forensic questions → answer each precisely from filters (host count from unique IPs, OS from TTL/User-Agent, first/last timestamps, etc.).
• Covert channel / exfil → DNS with long/odd subdomains = DNS tunneling; ICMP with payloads = ICMP exfil; decode the encoded data (often base32/base64/hex in the query names or payloads).