🔬

Network Forensics with Wireshark

Medium

Free preview · 2 of 5 steps

Packet capture as network evidence

Network forensics uses packet captures to reconstruct what happened during an incident. A PCAP file is the ground truth — every byte that traversed the network, with precise timestamps.

The analyst's job: filter the capture to relevant traffic, follow connections to understand sessions, decode protocols to extract content, and identify anomalous patterns that indicate attack behavior.

Packets in motion — click to inspect:

1 / 2

Space to play/pause · ← → to step