# Network Forensics Analysis

> Use when performing network forensic and pcap analysis.

- Skill: `loopyluci/network-forensics-analysis` (Agent Skill)
- Install (CLI): `npx skillmds@latest add loopyluci/network-forensics-analysis`
- Raw SKILL.md: https://api.skillmd.com/api/skills/loopyluci/network-forensics-analysis/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: LoopyLuci (https://skillmd.com/u/loopyluci)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/loopyluci/network-forensics-analysis

---


# Network Forensic Analysis

Analyzing packet captures and network evidence for security investigations — from capture methodology through protocol analysis, timeline reconstruction, and evidence preservation.

## When to Use

- Investigating a security incident from network evidence
- Analyzing pcap files for indicators of compromise
- Reconstructing network sessions and timelines
- Preparing network evidence for legal proceedings

## Forensics Process

```python
FORENSICS_PHASES = {
    'preservation': 'Capture and hash evidence, maintain chain of custody',
    'triage': 'Identify suspicious sessions, IPs, ports, and protocols',
    'analysis': 'Deep packet inspection, protocol decode, file extraction',
    'correlation': 'Correlate with logs, endpoints, and threat intel',
}
```

## Common Pitfalls

1. **Truncated captures** — missing packet payloads lose evidence
2. **No chain of custody** — evidence integrity must be provable
3. **Analyzing originals** — always work from copies, not original evidence
4. **Missing encrypted traffic** — focus on metadata, DNS, TLS handshakes
5. **No timeline** — timestamps need synchronized clocks (NTP)

## Verification Checklist

- [ ] Full packet captures with timestamps
- [ ] Cryptographic hashes of evidence files
- [ ] Chain of custody documented
- [ ] Timeline reconstructed from multiple sources
- [ ] Protocol analysis for HTTP, DNS, TLS covering attack vector