- [Instructor] Forensic investigators
are also often interested in the communications
sent and received by targeted systems over a network.
They may not have access to the system itself
or may simply want to get a complete picture
of a suspect's communications.
That's where network forensics come into play.
Network transmissions are digital,
consisting of ones and zeros
sent across some form of network media.
Ethernet networks send electrical impulses
over copper wire.
Fiber-optic networks use pulses of light
transmitted over strands of glass.
And wireless networks use radio waves
to send digital bits through the air.
Whatever media is used,
anyone with access to that media
can capture those pulses as they travel.
Copper and fiber optic cables may be tapped.
Wireless radio signals may be intercepted.
Switches and routers can be compromised.
An attacker might use these techniques
to surreptitiously eavesdrop on network communications.
Forensic analysts may use the same tools
to monitor suspicious network traffic.
The most comprehensive way to capture network information
is through the use of a protocol analyzer such as Wireshark.
These tools conduct full packet capture,
grabbing every bit that they see on a network
and then reconstructing it into the packets
used to exchange data between systems.
Let's take a look at Wireshark in action.
Here I have Wireshark running on a system.
As you can see, lines of traffic
are scrolling by pretty quickly here.
Each one of these lines,
it represents a single packet
being transmitted on the network.
If I just expand this column here,
you can see we've already captured
over 67,000 packets in this communication.
Each one of these packets has a timestamp.
In the case of Wireshark,
it starts at zero when the network traffic capture begins
and then just increments over time.
It includes the source and destination IP address
for each one of these packets.
And then some information about the protocol being used
and the length of the packet.
And then it tries to interpret that packet a little bit.
Down on the bottom, if I just click
on any one of these packets as it scrolls by,
I get further information.
There's some detailed header information here
and then the actual contents of the packet.
This is how a protocol analyzer can be used
to capture and store network traffic.
Wireshark's full packet capture capability
is a great tool, but it comes with one fatal flaw.
Full packet capture requires massive amounts of storage
if you want to retain all of the data that you're capturing.
If you know what you're looking for,
you can use filters to save only relevant information.
But those filters are only useful
when you know in advance that you'll be conducting
a forensic investigation.
In most cases, you don't know you'll need
network forensic information until after an incident occurs.
Network forensics then becomes a big data problem.
Fortunately, there are other ways
to save most of the important information
without requiring large amounts of storage.
That's where NetFlow data plays an important role.
Short for Network Flow,
NetFlow data captures high-level information
about all communications on a network.
It's similar to the information
that you'd find about phone calls on your telephone bill.
The bill tells you every phone number that you dialed
as well as the time and duration of the call.
It doesn't tell you what was said during that call.
NetFlow data gives you similar information
about network communications.
You'll find the source and destination IP addresses
of each network communication
as well as the network ports involved,
a timestamp, and the amount of data exchanged
in each communication.
This provides valuable who-talked-to-whom information
about network communications.
But just like a telephone bill doesn't include
the content of the telephone communication,
NetFlow data doesn't include the payload
of the packets that were transferred.
NetFlow data is often captured
by routers, firewalls, and other network devices
stationed at network choke points.