network-forensicslisted

# Network Forensics Methodology A capture room is NOT recon→foothold→privesc. You're not attacking a host — you're **reconstructing a story from traffic someone already recorded.** The arc is: load → get the overview → form a hypothesis about the story → follow it → extract the answer. The `/pcap` command has the tshark commands; this is how to think about the capture. ## 0. Classify the capture task first Read the room text — pcap rooms usually ask for one of these, and which one sets your whole path: - **Find a credential** — someone logged in over a cleartext protocol. - **Recover a file / data** — something was transferred (HTTP, FTP, SMB, TFTP) or exfiltrated. - **Reconstruct an attack** — "what did the attacker do?" scanning, brute force, exploitation, C2. - **Answer specific questions** — how many hosts, what OS, which port, what time (forensic quiz). - **Decode exfil / covert channel** — data hidden in DNS, ICMP, or an odd protocol. Name the target answer (flag string? a filename? an attacker IP? a count?) so you know when you're done. ## 1. Load & get the overview (always — cheap and orienting) Never start by scrolling packets. Get the shape of the capture first: - Protocol hierarchy — what protocols are even present, and in what proportion. - Conversations / endpoints — who talked to whom, and the heavy talkers. - Capture duration and packet count — is this seconds or days? The overview usually tells you where the answer lives. A capture that's 90% HTTP is a web