Skip to main content

Traffic Analysis and Forensics

Packet capture, protocol-level inspection and forensic reconstruction of network incidents. This subcategory covers the analyst's side of the wire: how to capture traffic correctly, how to read it efficiently, and how to answer the question "what actually happened on this network" from a PCAP.

The material is written for both sides of the same skill: an offensive operator who needs to understand how their traffic looks on the wire (and how to blend in), and a defensive analyst who needs to detect, triage and reconstruct adversary activity.

Format​

Each file uses the two-track format:

  • Offensive - how an attacker generates, obfuscates or hides the traffic being analysed.
  • Defensive - how a defender captures, detects and reconstructs that traffic.

The two tracks are complementary: you cannot reliably detect what you cannot generate, and you cannot evade what you cannot detect.

Files​

#FileFormat
01Packet Capture FundamentalsTwo-track
02Wireshark and tsharkTwo-track
03Network Forensics and PCAP AnalysisTwo-track
04Traffic Analysis for Incident ResponseTwo-track
05Covert Channels and Traffic ObfuscationTwo-track

Status: 5 files done.

Certification Alignment​

This subcategory maps to the following certifications:

CertificationRelevant domains
CompTIA Security+Domain 4 (Security Operations), Domain 3 (Security Architecture)
CompTIA CySA+Domain 1 (Security Operations), Domain 2 (Vulnerability Management), Domain 3 (Incident Response)
Cisco CyberOps AssociateDomain 3 (Host and Network Analysis), Domain 4 (Incident Response)

Traffic analysis and PCAP forensics appear in every blue-team certification at the operational level. The material here focuses on the practical skills those exams test: capture methodology, protocol parsing, timeline reconstruction and evidence handling.

See Also​

References​