# Network Evidence Acquisition

In many incidents, the only trace of the attacker is the traffic they generated communicating with their Command and Control (C2) servers or exfiltrating data. It is often said that while logs can be deleted and files can be wiped, "packets don't lie."

## Full Packet Capture (PCAP)
The ultimate form of network evidence is a Full Packet Capture. This records every single bit of data traversing the wire—the headers, the routing information, and the actual payload (the contents of the emails, the files being downloaded, the web pages viewed).

*   **Tools:** Wireshark, `tcpdump`.
*   **The Problem:** Storing full PCAPs is incredibly expensive. A busy corporate firewall might process 10 Terabytes of data per day. Retaining full PCAPs for 30 days requires massive, specialized storage clusters (like Arkime/Moloch). Because of this, most organizations do not save full PCAPs.

## NetFlow (Network Telemetry)
If you can't record the entire phone call (PCAP), the next best thing is to record the phone bill (NetFlow). 

NetFlow is metadata about network traffic. It records:
*   Source IP & Destination IP
*   Source Port & Destination Port
*   Protocol (TCP/UDP)
*   Total Bytes Transferred
*   Start time & End time

NetFlow does **not** record the payload. It cannot tell you *what* was inside the HTTP request, only that an HTTP request occurred and transferred 40MB of data.
*   **Pros:** Requires 99% less storage than full PCAPs. You can store months of NetFlow data easily.
*   **Usage in DFIR:** If an analyst sees a NetFlow record indicating 50 Gigabytes of data was sent from the internal Database Server to an unknown IP in Russia at 3:00 AM, they don't need the PCAP to know data exfiltration just occurred.

## Log Files
When PCAP and NetFlow are unavailable, analysts rely heavily on network appliance logs:
*   **Firewall Logs:** Shows allowed and blocked connections.
*   **Proxy Logs / Web Gateways:** Shows the exact URLs internal users visited, the user-agent strings, and HTTP status codes. This is critical for catching users clicking phishing links.
*   **DNS Logs:** Attackers frequently use DNS to locate internal assets or even to exfiltrate data (DNS Tunneling). Analyzing DNS queries is a staple of network forensics.

## Collecting Evidence on the Wire
How do we actually capture the traffic without interrupting the network?
1.  **Port Mirroring (SPAN Port):** You configure the corporate network switch to take a copy of every packet passing through it and send that copy to a dedicated monitor port, where your forensic capture tool is plugged in.
2.  **Network Taps:** A physical hardware device inserted directly inline with the network cable. It acts like a splitter, passively duplicating the optical or electrical signal to a capture device. Taps are completely invisible to the network and are more reliable than SPAN ports under heavy load.