Course 13 - Network Forensics | Episode 1: Fundamentals, Attack Vectors, and Digital Tracing | CyberCode Academy

In this lesson, you’ll learn about: Network Forensics – Key Concepts and Techniques In this lesson, you’ll learn about:

1. Network Fundamentals & Physical Security

Understanding how networks operate is essential for forensic analysis.
Physical access = high risk
- Coax-based networks are insecure.
- Wiring closets and data closets are prime targets.
- Example: An MIT associate once accessed a wiring closet, deployed a server, and was only detected via CCTV.
Network devices by OSI layer:
- Hub → Layer 1 repeater
- Switch → Layer 2 (MAC-based)
- Router → Layer 3
- Firewall → Layer 4 (TCP/UDP port filtering)
NAT ("poor man's proxy")
- Multiple internal IPs share one external IP.
- NAT blocks inbound attacks but is bypassed when an infected internal system creates an outbound tunnel.

2. Attack Vectors and Network Exploits Wireless as a major weakness

Wireless signals broadcast publicly, making them easy to attack.
Deauthentication attacks can be launched with cheap hardware (e.g., ESP8266 boards for $20-$25).

Core attack techniques

MAC Spoofing
- MAC addresses can be changed easily (e.g., using macchanger).
- Investigators look for activity stopping on one MAC/IP and continuing on another.
- Tracking spoofed devices typically requires WIPS and triangulation.
ARP Poisoning & MAC Flooding
- ARP poisoning redirects traffic by impersonating the gateway.
- MAC flooding forces switches to behave like hubs.
- Port security can mitigate these attacks.
DNS Poisoning
- Redirects a domain to an attacker-controlled IP.
- Local host files can be manipulated (e.g., domain → 127.0.0.1).
TCP/IP Spoofing
- Effective spoofing requires MITM positioning to block reset packets.
- Blind spoofing is used in large-scale DoS to confuse IDS systems.

3. Protocols, Encryption & Anonymity

Secure vs. insecure protocols:
- SSH (22) replaced Telnet (23).
- FTP sends credentials in plaintext.
- SNMP (161/162) must never be exposed externally due to sensitive config data.
Malware ports commonly observed:
- 666, 1337, 12345, 54321, 4444, 5555.
IPv6 & IPSec:
- IPv6 often uses IPSec, enabling point-to-point encrypted traffic that is difficult to intercept or spoof.
Tor and onion routing:
- Uses three layers of encryption across multiple nodes.
- Nearly impossible for a basic investigator to break.
- Only encrypted inside the Tor network—exit node traffic to non-HTTPS sites is exposed.

4. Forensic Tools & Investigation Methodology Log-Based Investigation

External attacks rely on:
- Router logs
- Firewall logs
- IDS logs
Internal attacks rely on logs from internal devices and systems.

Key Tools

Security Information Management Systems (SIMS)
- Aggregate logs from thousands of sources.
- Normalize data and identify correlated attack patterns.
Packet Sniffers & Protocol Analyzers
- Wireshark captures Layer 2 traffic.
- “Follow stream” helps isolate conversations and manually carve data.
Netstat
- Shows open ports and active network connections.
- Not forensically sound on original evidence—should be used only on a copy or VM.

Timestamp Synchronization

Timestamps are critical for correlating logs.
All systems should sync to a trusted NTP server.
If timestamps differ, investigators must calculate and apply the correct offset.

You can listen and download our episodes for free on more than 10 different platforms:
https://linktr.ee/cybercode_academy

Course 13 - Network Forensics | Episode 1: Fundamentals, Attack Vectors, and Digital Tracing