Network Forensics

Network forensics is the capture, recording, and analysis of network traffic to detect intrusions, reconstruct events, and gather evidence. Unlike disk and memory forensics, which examine data at rest, network forensics analyses data in motion — the packets flowing between systems.

---

Why Network Forensics Matters

Use Case	Description
Intrusion detection	Identify malicious traffic that bypassed perimeter defences
Data exfiltration analysis	Determine what data was transmitted out of the network
Malware communication	Identify command-and-control (C2) traffic patterns
Insider threat investigation	Monitor for unauthorised data transfers or policy violations
Incident timeline reconstruction	Correlate network events with host-based evidence
Compliance monitoring	Verify adherence to network security policies

---

Full Packet Capture vs Flow Data