thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Network Forensics

Capturing and analyzing network traffic and logs to investigate security incidents.

Definition

Network forensics uses full packet capture, flow data, proxy, DNS and firewall logs to reconstruct communications, identify C2 channels, extract transferred files and determine data exfiltration. Encryption limits content visibility, making metadata such as JA3/JA4 fingerprints and SNI important.

Example

Extracting a malware download from a PCAP with Wireshark's Export Objects feature.

Exam tip

Without prior capture, network evidence is lost; packet capture must be in place before the incident.

Related terms