Network forensics

01Scope

Full packet capture (pcap/pcapng): sessions, protocols, extracted files, TLS metadata
Flow records (NetFlow, IPFIX, sFlow) and firewall connection logs
DNS query logs, DHCP lease logs, proxy and web gateway logs
VPN, RADIUS and 802.1X authentication records
Address translation: NAT, CGNAT, and what ISP records can and cannot resolve

Which internal device used this public address and port at this UTC second?
Was data transferred out, how much, to where, and over which protocol?
Which domains were resolved before a connection, and by which host?
Did a remote session (RDP, SSH, VPN) occur, from which address and for how long?
Are the clocks of the logging devices synchronised, and by how much do they differ?

Source	What it yields	Note
Packet capture at a defined point (span port, tap, host)	Complete sessions, headers, payloads where unencrypted, TLS SNI and certificates	Record the capture point, interface, filter, start/end, dropped-packet count and file hash.
Flow records and firewall logs	Who talked to whom, when, ports, byte counts; no content	Sampling (e.g. 1 in 1000) and active-timeout splitting change what a 'flow' means; read the exporter configuration.
DHCP and DNS server logs	Address-to-MAC lease history; names resolved per client	Leases overlap and renew; the MAC can be randomised on modern clients.
Proxy, web gateway and VPN concentrator logs	Authenticated user, URL or domain, bytes, time; VPN assigned addresses	These are often the only records that name an account rather than an address.
ISP or carrier records for a public address	Subscriber behind a public address at a time, within CGNAT limits	Without the source port and exact UTC time, a CGNAT address maps to many subscribers.

Fix the clocks first
For every log source, establish its time zone and its offset from a reference (NTP state, a known event seen by two devices). Record offsets per device and apply them explicitly.
Define the capture point and its blind spots
A capture behind NAT sees private addresses; a capture at the edge sees translated ones. Traffic on other paths, or encrypted, is not 'absent', it is unseen.
Reconstruct sessions, then attribute addresses
Reassemble TCP streams and extract objects; then walk the address back through NAT tables, DHCP leases and authentication logs with times aligned.
Quantify transfers
Byte counts per direction, per session and per destination, in a table with the log source for each number.
State where attribution stops
Address to device is a log chain; device to person needs endpoint or account evidence. Write the two separately.

The library records behind this area:

A public IP address identifies a subscriber connection at best, not a person or even a single device.
IP geolocation databases are commercial estimates with city-level error at best; they are not evidence of location.
Flow 'start' times depend on exporter caching; two exporters give different times for the same session.
TLS hides content but not metadata; the SNI and certificate are still visible and reportable.
Log retention is short; request preservation immediately and record what was already gone.

Each log source with its owner, time zone, clock offset, retention and the period it covers.
Capture point, filter and dropped-packet statistics for any packet capture.
The attribution chain as a table: public address and port, NAT record, private address, lease, device, account, with the time of each link.
Explicit statement of what the network evidence cannot show (content, person).

How were the clocks of the different log sources aligned, and what offsets were applied?
At which link does the attribution chain stop, and why?
Was the capture complete for the period, or sampled or filtered?
Does the report rely on IP geolocation, and is it labelled as an estimate?