Network Forensics Analysis

The talk opens by defining network forensics as the monitoring and analysis of network traffic for information gathering, legal evidence or detection. The speaker argues that advanced persistent threat groups often avoid leaving files behind, which makes packet captures a valuable source. The overview covers common tooling: Wireshark and its command-line version, tcpdump for fast capture handling, Zeek for protocol metadata, Snort and Suricata for signature matching, and NetworkMiner for pulling files out of a capture.

The middle of the talk focuses on encryption, the main obstacle to investigators. Fingerprinting is presented as a workaround. JA3 and JA3S hash parameters from TLS client and server hellos, JARM actively probes servers to group them by their TLS configuration, and SSH handshake data reveals client software and operating system. RDP sessions can also leak usernames in cleartext fields. The speaker stresses limitations: attackers can reorder ciphers and extensions to change hashes, and shared hashes cause false positives. Large captures are handled by slicing with editcap, splitting and merging files, then scanning the result with signatures. Case studies show malware resolving command-and-control domains through a public DNS-over-HTTPS service and retrieving a base64-encoded binary over ordinary HTTPS, so the traffic looks like normal web activity.

The takeaway is to maintain an asset inventory and traffic baselines, combine network data with host telemetry, and treat fingerprints as context rather than proof.