Read as
Why this module exists. Network forensics — PCAP analysis, NetFlow investigation, full-packet inspection — is what reconstructs attacker activity from network traces. This module covers the tools, techniques, and operational patterns.
The network-forensics evidence layers
| Layer | What it shows |
|---|---|
| Full PCAP | Every byte of every packet |
| NetFlow / IPFIX / sFlow | Conversation summaries (src, dst, bytes, duration) |
| Zeek / Bro logs | Protocol-decoded conversation logs |
| DNS / Proxy logs | Application-layer name resolution / web access |
| Firewall logs | Connection accept / deny events |
Each layer trades storage for fidelity. Mature programmes capture multiple layers.
Want this for your team?
Custom team training + practitioner advisory
Beyond the free academy — we run private workshops, vCISO advisory, and red-team exercises tailored to your stack. For Indian SMBs scaling past their first hire.
Book team training call
Replies in 4 working hrs · India-only · Senior consultants