<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-network-forensics
description: >-
  Network traffic forensic analysis including PCAP capture and examination,
  protocol dissection, DNS query reconstruction, HTTP session extraction,
  TLS certificate analysis, network flow analysis, and intrusion detection
  using Wireshark, tshark, Zeek, and NetworkMiner.
domain: cybersecurity
subdomain: digital-forensics
tags:
  - network-forensics
  - pcap
  - wireshark
  - tshark
  - zeek
  - dns-analysis
  - flow-analysis
  - packet-capture
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1040", "T1071", "T1573"]
  nist-csf: ["RS.AN-3", "DE.CM-1"]
  frameworks: ["NIST SP 800-86"]
---

# Performing Network Forensics

## Overview

Network forensics captures and analyzes network traffic to reconstruct
communication patterns, identify data exfiltration, detect C2 channels,
and gather evidence of unauthorized access. This skill covers PCAP analysis,
protocol dissection, DNS reconstruction, TLS inspection, and automated
analysis with Zeek/Bro for large-scale investigations.

## Prerequisites

- Wireshark / tshark for packet analysis
- Zeek (formerly Bro) for protocol logging
- tcpdump for capture
- NetworkMiner for artifact extraction
- Python 3.10+ with `scapy`, `dpkt`

```bash
sudo apt install wireshark tshark tcpdump zeek
pip install scapy dpkt
```

## Key Concepts

### Capture Methods

| Tool | Use Case | Command |
|------|----------|---------|
| tcpdump | Lightweight CLI capture | `tcpdump -i eth0 -w capture.pcap` |
| dumpcap | Wireshark's capture engine | `dumpcap -i eth0 -w capture.pcapng` |
| Zeek | Protocol-level logging | `zeek -r capture.pcap` |

### Evidence Extraction Types

```
Network forensic artifacts:
├── DNS queries → domain lookups, C2 domains, tunneling
├── HTTP requests → URLs, user agents, file downloads
├── TLS handshakes → server certificates, SNI, JA3 hashes
├── SMTP traffic → email content (if unencrypted)
├── SMB/CIFS → file transfers, lateral movement
├── FTP → file transfers, credentials (plaintext)
├── SSH → connection metadata (encrypted content)
└── NetFlow/IPFIX → connection summaries (src/dst/port/bytes)
```

## Workflow

### Step 1: PCAP Analysis with tshark

```bash
# Capture statistics
capinfos capture.pcap

# Protocol hierarchy
tshark -r capture.pcap -z io,phs

# DNS queries
tshark -r capture.pcap -Y "dns.qr == 0" -T fields \
  -e frame.time -e ip.src -e dns.qry.name -e dns.qry.type

# HTTP requests
tshark -r capture.pcap -Y "http.request" -T fields \
  -e frame.time -e ip.src -e ip.dst -e http.host \
  -e http.request.uri -e http.user_agent

# TLS Server Name Indication (SNI)
tshark -r capture.pcap -Y "tls.handshake.extensions_server_name" \
  -T fields -e ip.dst -e tls.handshake.extensions_server_name

# Extract files from HTTP streams
tshark -r capture.pcap --export-objects http,./extracted_http/

# Conversations summary
tshark -r capture.pcap -z conv,tcp -q
tshark -r capture.pcap -z conv,ip -q
```

### Step 2: Zeek Log Analysis

```bash
# Process PCAP with Zeek
zeek -r capture.pcap

# Generated log files:
# conn.log      — All connections (IP, ports, bytes, duration)
# dns.log       — DNS queries and responses
# http.log      — HTTP requests/responses
# ssl.log       — TLS handshake details
# files.log     — File transfers
# notice.log    — Alerts and anomalies
# weird.log     — Protocol violations

# Query conn.log for long connections (potential C2)
cat conn.log | zeek-cut id.orig_h id.resp_h id.resp_p duration orig_bytes resp_bytes | \
  sort -t$'\t' -k4 -rn | head -20

# DNS queries to unusual TLDs
cat dns.log | zeek-cut query answers | grep -E '\.(xyz|top|club|tk|ml)$'
```

### Step 3: Python PCAP Analysis

```python
from scapy.all import rdpcap, DNS, DNSQR, IP, TCP

def analyze_dns(pcap_path: str) -> list[dict]:
    packets = rdpcap(pcap_path)
    queries = []
    for pkt in packets:
        if pkt.haslayer(DNS) and pkt[DNS].qr == 0:
            queries.append({
                "timestamp": float(pkt.time),
                "src_ip": pkt[IP].src if pkt.haslayer(IP) else "",
                "query": pkt[DNSQR].qname.decode() if pkt.haslayer(DNSQR) else "",
                "type": pkt[DNSQR].qtype if pkt.haslayer(DNSQR) else 0,
            })
    return queries

def extract_connections(pcap_path: str) -> list[dict]:
    packets = rdpcap(pcap_path)
    conns = {}
    for pkt in packets:
        if pkt.haslayer(TCP) and pkt.haslayer(IP):
            key = (pkt[IP].src, pkt[IP].dst, pkt[TCP].dport)
            if key not in conns:
                conns[key] = {"src": key[0], "dst": key[1],
                              "dport": key[2], "packets": 0, "bytes": 0}
            conns[key]["packets"] += 1
            conns[key]["bytes"] += len(pkt)
    return sorted(conns.values(), key=lambda x: x["bytes"], reverse=True)
```

### Step 4: JA3 TLS Fingerprinting

```bash
# Generate JA3 hashes from PCAP
# JA3 fingerprints the TLS client hello for threat detection
zeek -r capture.pcap ja3  # Requires ja3 Zeek package

# Manual JA3 with tshark
tshark -r capture.pcap -Y "tls.handshake.type == 1" -T fields \
  -e ip.src -e tls.handshake.version \
  -e tls.handshake.ciphersuite \
  -e tls.handshake.extensions.supported_group \
  -e tls.handshake.extensions.ec_point_format

# Known malicious JA3 hashes: check against ja3er.com database
```

## Detection

```yaml
title: Network Forensics Detection
id: 0944a32f-e0f8-4ed9-a205-7feb0ced8a0d
status: experimental
description: Detects suspicious activity related to performing network forensics techniques in digital forensics context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*network*"
  condition: selection
level: medium
tags:
  - attack.t1040
  - attack.t1071
  - attack.t1573
  - attack.collection
falsepositives:
  - Forensic investigation tools used by authorized incident response team
```

## Verification

- [ ] PCAP integrity verified (file not truncated)
- [ ] Protocol hierarchy reviewed for unexpected protocols
- [ ] DNS queries analyzed for suspicious domains and tunneling
- [ ] HTTP/HTTPS traffic examined for C2 patterns and data exfiltration
- [ ] TLS certificates and JA3 hashes checked against threat intelligence
- [ ] Connection patterns analyzed for beaconing behavior
- [ ] Extracted files hashed and submitted for malware analysis

## References

- [Wireshark User Guide](https://www.wireshark.org/docs/wsug_html/)
- [Zeek Documentation](https://docs.zeek.org/)
- [JA3 TLS Fingerprinting](https://github.com/salesforce/ja3)
- [MITRE T1071 — Application Layer Protocol](https://attack.mitre.org/techniques/T1071/)
- [NetworkMiner](https://www.netresec.com/?page=NetworkMiner)
