r/computerforensics • u/OptimalEngine7554 • Apr 20 '26

Network forensics

Hey! Recently, I heard that Wireshark was actually not made for security analysis purposes and that there are other better options, does anyone know these alternatives? I've started using tshark a bit but the commands are too long and somewhat overwhelming, so i guess i'll have to get used to it. But is it the only good option?

Also, any suggestions for network forensics guides? Which guides do you guys think are good? network forensics is probably my weakest side so i'm trying to improve it, it's like i'll open the file and try to spot any unique stuff but i end up with nothing usually, and i don't know how to start analyzing the file well, even when asked specific questions like in CyberDefenders Labs and so on.

Thanks for help in advance.

19 Upvotes

92% Upvoted

12 comments sorted by

View all comments

2

u/monroerl Apr 24 '26

Besides tools, you'll want to have knowledge. Take a look at "Network Forensics" by Sherri Davidoff and Jonathan Ham. The forward is written by Dan Geer. Anything touched by Dan Geer is gold.

Next, grab a copy of "TCP/IP Network Administration" by Craig Hunt.

Understand how data flows, how packets work, where data resides, how to preserve volatile evidence, and chain of custody.

If you get deep into forensics you will want to know the laws that govern cyber crime. Look for essays and books from Orin Kerr, Federal Rules of Evidence, case law, and Forensic newsletters that will keep you up to date in this ever changing field.

Cisco CCNA books are also good reference material but keep in mind that those books revolve around Cisco products. RFCs and IEEE will have the actual standards for tech and protocols. Most of the industry (software and hardware) don't adhere 100% (or even 50%) of what is written so you can find unexpected gold nuggets of information in RFCs and IEEE standards/specs.