GNFA · Domain 3
Open Source Network Forensics
About 25% of the exam
Open source collection stack
- Packet capture
- raw frames written to disk
- Session sensor
- structured logs per protocol
- Signature engine
- rule matches with packet context
- Flow collector
- long retention conversation metadata
- File extraction
- objects carved and hashed automatically
- Search platform
- everything indexed for pivoting
Acquisition principles
- Collect passively wherever possible
- Never inject traffic onto the monitored link
- Hash the capture as soon as it closes
- Record sensor, filter, and clock source
- Keep the original, analyze a copy
- Note dropped packets honestly
- Document what the sensor could not see
A defensible capture is a documented one: placement, tool, filter, clock and integrity hash
Capture planning
- Match sensor throughput to link speed
- Rotate files by size or time
- Use hardware timestamps at high rates
- Filter only what law or policy demands
- Store to fast disk, archive later
- Test restore before you need it
Alert to evidence
- Signature fires
- Pull the session log
- Open the packets
- Confirm success or failure
- Extract indicators
- Sweep the environment
An alert names a suspicion; the packets decide whether the attempt actually worked
Sensor log families
Connections
- Duration, bytes and packets each way
- State field summarizes the outcome
- No reply and rejected mark scanning
- Normal completion marks real transfers
Application logs
- Name service queries and answers
- Web host, path, method and agent
- Session parameters and certificate detail
- File objects with type and hash
Frameworks
- Notice framework raises findings
- Intelligence framework matches indicators
- File framework extracts and hashes
- Scripts add custom detections
Turning packets into structured logs is what makes weeks of traffic searchable in seconds
Covert channels by protocol
- Name service tunnel
- encoded labels, text record replies
- Echo channel
- oversized ping payloads carry data
- Web tunnel
- requests and replies wrap a session
- Shell tunnel
- port forwarding through an encrypted session
- Header ordering
- field sequence encodes the message
- Timing channel
- packet gaps carry the bits
- Dead drop
- commands staged on legitimate services
Detecting tunneling
- High entropy labels under one domain
- Query volume far above the user baseline
- Text and null record types dominating
- Payload sizes far from protocol norms
- Long sessions with lopsided byte counts
- Cumulative counting beats per hour thresholds
Beaconing analysis
- Look for regular intervals with jitter
- Consistent request and response sizes
- Sleep timers from seconds to days
- Working hours patterns hide inside noise
- Weeks of flow data beat one capture
- Cluster by fingerprint, not by address
Jitter hides the rhythm from a threshold but not from a distribution over weeks
Steganography and staging
- Payload hidden in image least significant bits
- Data appended after the image end marker
- Metadata fields carrying encoded content
- Uploads to consumer file sharing services
- Archive split into small innocuous pieces
- Encryption before exfiltration defeats content inspection
Building the network narrative
Phases to prove
- Reconnaissance and scanning
- Delivery and exploitation
- Command channel established
- Lateral movement between hosts
- Staging and exfiltration
Evidence per phase
- Many refused connections show scanning
- Request and response prove exploitation
- Repeating sessions prove the channel
- File share and remote service traffic show movement
- Outbound volume proves the transfer
Network evidence reconstructs the visible path; host artifacts explain what happened between the packets
Handling and integrity
- Acquisition hash
- computed when the file closes
- Working copy
- analysis never touches the original
- Custody record
- who pulled it and when
- Tool validation
- known input, expected output, documented
- Sensor logs
- prove the capture was passive
- Retention policy
- explains why older data is gone
Reporting network findings
- State the sensor position and coverage
- Give timestamps in one reference zone
- Show the indicator and its source
- Separate observed traffic from inference
- List what encryption prevented you seeing
- Provide indicators others can hunt with
Key artifacts
- Connection state
- how the session ended
- Extracted file hash
- pivot into reputation and sweeps
- Client fingerprint
- clusters tools across changing addresses
- Query entropy
- randomness suggesting encoded data
- Interval and jitter
- beacon rhythm with deliberate variation
- Byte ratio
- upload heavy sessions suggest exfiltration
Know the order
- Preserve the capture
- Hash and copy
- Index into logs
- Triage the alerts
- Extract indicators
- Sweep and report
Preserve before you process: indexing is repeatable, but a lost capture window never comes back
Reference strip: open source forensics
Collection
- Passive tap or mirror
- Rotating full packet capture
- Flow export for long retention
- Extraction of transferred files
Structuring
- Connection and application logs
- Certificate and session records
- Notice and intelligence matches
- Search index across all sources
Covert channels
- Name service and echo tunnels
- Web and encrypted shell tunnels
- Header order and timing channels
- Dead drops on legitimate services
Detection ideas
- Entropy and label length
- Interval regularity with jitter
- Byte ratio and session duration
- Fingerprint reuse across hosts
Defensibility
- Hash at collection
- Documented sensor placement
- Validated tools and versions
- Custody record for every copy
Quick exam traps
- Trap: Passive collection needs no custody record
- Trap: A signature alert alone proves compromise
- Trap: Jittered beacons cannot be detected statistically
- Trap: Encrypted exfiltration leaves no observable pattern
- Trap: One capture window is enough to spot slow tunneling
- Trap: Extracted files need no hashing because the capture is hashed
cybercertprep.com · original revision sheet written from the public body of knowledge