Network Forensics with PCAP
Reconstructing attacks from traffic.
Network Forensics with PCAP is a free Cyber Security Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What Network Forensics Captures
Network forensics analyzes captured traffic to reconstruct what happened on the wire: connections, transferred files, command-and-control, and data exfiltration.
Unlike disk forensics, network evidence is ephemeral. If you were not capturing during the event, the packets are gone. This is why organizations deploy full-packet capture and flow logging in advance.
PCAP and Capture Tools
The PCAP (packet capture) format stores raw frames with timestamps. tcpdump and tshark capture from a tap or SPAN port.
Capture forensically: write to file, do not resolve names live (DNS lookups add noise), and record the capture filter used.
# Capture all traffic on eth0 to a rotating set of files
tcpdump -i eth0 -n -s 0 -w capture-%Y%m%d-%H%M%S.pcap -G 3600
# -n no name resolution
# -s 0 full packet (snaplen)
# -G 3600 rotate hourlyFull Packet vs Flow Data
Two evidence tiers:
- Full packet capture (PCAP): every byte, enabling content reconstruction, but storage-heavy
- Flow data (NetFlow/IPFIX): metadata only, who talked to whom, when, how much, but no payload
Flow records are cheap to retain long-term and excellent for spotting beaconing and exfil volume, then you pivot to PCAP for detail.
Wireshark Display Filters
Wireshark (and tshark) use display filters to isolate relevant traffic. Master a few and analysis speeds up dramatically.
# Traffic to/from a suspect host
ip.addr == 10.0.0.66
# DNS queries only
dns.flags.response == 0
# HTTP requests
http.request
# TCP retransmissions (possible tampering or instability)
tcp.analysis.retransmissionFollowing Streams
TCP reassembly stitches packets back into the original conversation. Follow TCP Stream in Wireshark (or tshark -z follow) reconstructs an HTTP exchange, a chat, or a transferred file.
This reveals plaintext credentials, exfiltrated documents, and attacker commands when traffic is unencrypted.
# Reconstruct TCP stream index 5 as raw bytes
tshark -r capture.pcap -z follow,tcp,raw,5 -qExtracting Transferred Files
Files moved over HTTP, FTP, or SMB can be carved out of a capture. Wireshark exports objects, and tcpflow or foremost reconstruct payloads.
Hash extracted files and check them against threat-intel sets to identify malware delivery.
# Reassemble flows into per-connection files
tcpflow -r capture.pcap -o extracted/
# Export HTTP objects via tshark
tshark -r capture.pcap --export-objects http,http_objects/DNS as an Indicator
DNS reveals a lot even when payloads are encrypted:
- DGA domains: long random-looking names suggest malware
- High NXDOMAIN rate: domain-generation attempts
- DNS tunneling: oversized or high-frequency TXT/NULL queries carrying data
Baselining normal DNS makes anomalies stand out.
# Count queries per domain to spot beaconing or tunneling
tshark -r capture.pcap -Y dns.flags.response==0 \
-T fields -e dns.qry.name | sort | uniq -c | sort -rn | headDetecting Beaconing
Command-and-control channels often beacon at regular intervals to a controller. Forensically, you look for:
- Regular, periodic connections to one destination
- Small, consistent payload sizes
- Long-lived sessions or fixed jitter
Flow analysis (connection timing) usually surfaces beaconing faster than packet inspection.
Encrypted Traffic Analysis
Most modern traffic is TLS-encrypted, so payloads are opaque. You analyze metadata instead:
- SNI and certificate fields (when visible)
- JA3/JA3S fingerprints of the TLS handshake to identify client tooling
- Packet sizes and timing
If TLS keys were captured (SSLKEYLOGFILE in a lab) Wireshark can decrypt, but this is rare in real evidence.
# Extract TLS server names (SNI) from a capture
tshark -r capture.pcap -Y 'tls.handshake.type==1' \
-T fields -e tls.handshake.extensions_server_name | sort -uCorrelating with Logs
Network evidence is strongest when correlated with host and infrastructure logs: firewall denies, proxy logs, IDS alerts (Suricata/Zeek), and endpoint telemetry.
Zeek turns raw PCAP into structured logs (conn.log, dns.log, http.log, files.log) that are far easier to pivot through than packets alone.
# Generate Zeek logs from a capture
zeek -r capture.pcap
# Inspect connection summary
cat conn.log | zeek-cut id.orig_h id.resp_h proto duration orig_bytes resp_bytesCapture Integrity and Storage
A PCAP is evidence too, so it gets the same rigor as a disk image: hash it on acquisition, store it read-only, and document the capture point, interface, and clock source.
- Note whether the tap saw both traffic directions
- Record dropped-packet counts (gaps weaken conclusions)
- Preserve the original capture; analyze a copy
# Hash the capture and report stats including drops
sha256sum capture.pcap
capinfos capture.pcap | grep -E 'packets|drop|duration'Quick Check
Test your network forensics knowledge.
Recap
You learned to reconstruct attacks from traffic:
- PCAP captures everything; flow data scales for long-term metadata
- Display filters and stream-following isolate and reassemble conversations
- Object extraction recovers transferred files
- DNS analysis and beacon detection surface C2 and tunneling
- Encrypted traffic is judged by metadata and JA3
- Zeek and log correlation tie it together
Next: weaving disk and network artifacts into a timeline and report.
Frequently asked questions
Is the “Network Forensics with PCAP” lesson free?
Yes — the full text of “Network Forensics with PCAP” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “Network Forensics with PCAP”?
Reconstructing attacks from traffic. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Network Forensics with PCAP” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.