Netzwerkforensik
Network Forensics
Netzwerkforensik
Network forensics is the investigation of network traffic and records in order to reconstruct an attack — which connections existed, which data flowed, with which counterparts communication took place. It looks at the traces an attacker leaves in the network, rather than only those on an endpoint. Often it is the key to proving data exfiltration and control (C2).
History & facts. In contrast to disk forensics, network forensics examines volatile traces: connection data, protocol captures and metadata. Sources include full packet captures (PCAP), flow data and the logs of security sensors. Because many attacks at some point communicate outward — for downloading, control or data exfiltration — it is often possible to prove here what was obscured at the endpoint. The evidence, however, exists only if the traffic was previously recorded.
Outlook & recommendation. The practical bottleneck is recording: what was not captured cannot be analysed after the fact. Continuous network observation (Network Detection and Response (NDR)/NSM) creates the data basis and reveals processes precisely where no agent runs at the endpoint — such as with Operational Technology (OT), IoT or unmanaged devices. Increasing encryption shifts the focus from content towards metadata and behavioural patterns.