1. What is FORENSICS?
Why do we need Network Forensics?
Why it is so important?

2. Introduction
Network – Interconnection of computers by communicating channels
Large amount of Data or Packets transferring at each interval of time
Attacks may be either passive or active
Network Forensics is like camera on the network
discover the source of security attacks
provides useful tools for investigating cybercrimes on the Internet

3. Network Forensics Analyzing the network traffic
Examining the network devices like Routers
Data rate is very fast
Need to store the packets to find the behavior
Deal with volatile and dynamic information
Identify all possible security violations
Identify malicious activities from the traffic logs and discover their details, and to assess the damage

4. Definition:
Act of capturing, recording, and analyzing network audit trails in order to discover the source of security breaches or other information assurance problems.
Systems collect data in two forms:
"Catch-it-as-you-can" –
Packets passing through certain traffic point are captured
Analysis is done subsequently
Requires large amounts of storage.
"Stop, look and listen" –
Packet is analyzed in memory
Certain information saved for future analysis.

5. Capabilities
Comprehensive data collection:—anything that crosses the network, whether , IM, VoIP, FTP, HTML, or some other application or protocol — collected by a single system and stored in a common, searchable format
Flexible data collection: Collect all data on a network segment for future inspection or focus on a specific user or server.

6. Catching hackers on the wire
Attackers fingerprints remain throughout the network, in firewall logs, IDS/IPS, web proxies, traffic captures

7. Ethernet
--data on this layer is collected using network interface card (NIC) of a host.
-- it collects all the traffic that comes over the network.
TCP/IP
--in this routing tables are used to identify attackers.
--a part from routing tables, authentication logs are also used in this layer.
The Internet
--Web server logs are used here.
--used to extract user account information.

8. Network forensics includes
preparation
collection
preservation
examination
analysis
Investigation
presentation
Network Forensic Analysis Tools (NFATs)
administrators to monitor networks,
gather all information
about anomalous traffic
assist in network crime investigation

9. A Generic Framework for Network Forensics
Preparation and authorization
Collection of network traces
Preservation and protection
Examination and analysis
Investigation and attribution
Presentation and review

10. Network forensic analysis
open source and proprietary security tools
Wire shark
Tcp dump
Snort
Wire Shark
also known as Ethereal
used in ETHERNET layer
uses pcap to capture data
data is captured from live traffic or read from a file that recorded already
VoIP calls can be detected in the captured traffic

13. Conclusion
real world method of initially identifying and responding to computer crimes and policy violations
data mining tools, network engineers have the data they need to identify and fix problems
security teams can reconstruct the sequence of events

14. References en.wikipedia.org/wiki/Network_forensics
portforward.com/networking/wireshark.htm
ieeexplore.ieee.org/stamp/stamp.jsp