◇ OpenCyber Academy
Engineering · Chapter 11 · English

Chapter 11 — Networks and protocols

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 11 — Networks and protocols

Lesson map

Lesson 11 published. Map, example, EX031.

flowchart TD
  N0["Learning outcomes"]
  N1["11.1 Layers"]
  N2["11.2 Captures and flows"]
  N3["11.3 DNS"]
  N4["11.4 Encryption"]
  N5["11.5 Time"]
  N6["11.7 Volatile network state"]
  N7["Wireless and mobile networks"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX031"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["11.1 Layers"]
  N2["11.2 Captures and flows"]
  N3["11.3 DNS"]
  N4["11.4 Encryption"]
  N5["11.5 Time"]
  N6["11.7 Volatile network state"]
  N7["Wireless and mobile networks"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX031"]

[Learning outcomes]
    |
    v
[11.1 Layers]
    |
    v
[11.2 Captures and flows]
    |
    v
[11.3 DNS]
    |
    v
[11.4 Encryption]
    |
    v
[11.5 Time]
    |
    v
[11.7 Volatile network state]
    |
    v
[Wireless and mobile networks]
    |
    v
[Worked example] --> [Exercise EX031]

Learning outcomes

You will (1) explain the layers relevant to network forensics; (2) identify artefacts each layer leaves; (3) reason about packet captures and flow records; (4) respect legal limits on interception.

11.1 Layers

Ethernet frames carry IP packets, which carry TCP or UDP segments, which carry application data such as HTTP or DNS. Each layer has addresses and metadata useful to investigators: MAC addresses, IP addresses, ports, domain names.

Each layer answers a different question. MAC addresses identify interfaces on the local segment and change at every router hop, so they matter mainly inside one network. IP addresses identify endpoints across networks, but address translation can hide many machines behind one. Ports suggest which service was involved, and application data says what was asked for. Priya annotates every finding with the layer it came from, so readers know how far each identifier can be trusted.

11.2 Captures and flows

A full packet capture records contents; a flow record (such as NetFlow or IPFIX) records only who talked to whom, when and how much. Flows are smaller and less intrusive but cannot show content.

A day of full capture on a busy office link can take terabytes, while flow records for the same day may fit in a few gigabytes. Flows still answer many questions: whether a host talked to a given address, for how long and how many bytes moved in each direction. A large outbound transfer at 02:00 shows up clearly in flows even when the content is encrypted. Priya practises with synthetic flows before touching any capture.

11.3 DNS

DNS logs show which names a host looked up. A lookup does not prove a connection followed, but it narrows the story.

Caching complicates the picture. A host may resolve a name once and connect many times without further lookups, and a resolver's log shows only queries that reached it. Some lookups come from browsers prefetching links the user never clicked. Priya pairs DNS records with flow records: a lookup for a name followed within seconds by traffic to the returned address is far stronger evidence than the lookup alone.

11.4 Encryption

Most web traffic uses TLS. Content is hidden, but metadata such as the server name indication may remain visible, depending on the protocol version and configuration.

Even with content hidden, timing, packet sizes, the certificate presented and the volume of each session can show a lot. Encrypted client hello and similar extensions are designed to hide the server name, so analysts cannot assume it will always be visible. Interception inside an organisation needs explicit authority and a documented setup, and a forensic report says which visibility applied to each capture.

11.5 Time

Network devices may have unsynchronised clocks; correlating logs requires knowing each device's offset.

Priya measures offsets using events that appear in two sources, such as a firewall entry and a server log line for the same connection. If the firewall consistently reads 47 seconds ahead, she records that offset with its supporting pairs and applies it before building a timeline. She also checks that the offset stays stable over the period, because a drifting clock needs a correction that changes over time, not a single constant.

11.6 Legal limits

Capturing communications content is regulated by law in most countries. Labs act only under proper authority; students analyse synthetic captures only.

Authority usually depends on who owns the network, what users were told and what a warrant or policy permits, and the rules for metadata may differ from those for content. Engineers designing capture systems build in filters that keep only what the authority covers. Synthetic captures in the course reproduce realistic protocols and timing without containing any real person's communications.

11.7 Volatile network state

Active connections and ARP caches on a live host are volatile and, per RFC 3227, collected before less volatile data where authority allows.

On a running host, the list of established connections shows remote addresses and the processes that own them, and the ARP cache maps local IP addresses to MAC addresses seen recently. Both change within seconds to minutes. Priya's collection script captures them first, writes the output to external media with a hash and logs its own commands, so the small changes it makes are documented.

Wireless and mobile networks

Wi-Fi association logs and mobile network records add location and time context. They show which access point or cell served a device, not where its owner stood to the metre.

Worked example

A synthetic firewall log shows a laptop sent 2 GB to an external IP at 02:00, while DNS logs show a lookup for a file-sharing service a second earlier. Priya writes: "The laptop transferred about 2 GB to an address the DNS log associates with a file-sharing service. Contents are not visible; the transfer volume and timing are consistent with a file upload."

Synthetic case. The logs are invented.

Errors and limits

IP addresses identify network endpoints, not people; NAT and shared networks complicate attribution.

Exercises

Synthesis

Each layer leaves different artefacts; read them together, mind clocks and law, and attribute to endpoints, not people.

Continue studying — chapter 11 of 50

← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →