Network Forensics

---
name: network-forensics
description: Methodology for TryHackMe packet-capture / traffic-analysis rooms. Use when the room hands you a .pcap/.pcapng (or a Wireshark/tshark task), when the goal is to reconstruct what happened on the wire, or when asked "what next" on a capture. Guides the load → overview → follow-the-story → extract flow, distinct from the box-owning recon→foothold→privesc arc. The /pcap command supplies the tshark mechanics; this skill supplies how to think about a capture.
---

# Network Forensics Methodology

A capture room is NOT recon→foothold→privesc. You're not attacking a host — you're
**reconstructing a story from traffic someone already recorded.** The arc is:
load → get the overview → form a hypothesis about the story → follow it → extract the answer.
The `/pcap` command has the tshark commands; this is how to think about the capture.

## 0. Classify the capture task first
Read the room text — pcap rooms usually ask for one of these, and which one sets your whole path:
- **Find a credential** — someone logged in over a cleartext protocol.
- **Recover a file / data** — something was transferred (HTTP, FTP, SMB, TFTP) or exfiltrated.
- **Reconstruct an attack** — "what did the attacker do?" scanning, brute force, exploitation, C2.
- **Answer specific questions** — how many hosts, what OS, which port, what time (forensic quiz).
- **Decode exfil / covert channel** — data hidden in DNS, ICMP, or an odd protocol.
Name the target answer (flag string? a filename? an attacker IP? a count?) so you know when you're done.

## 1. Load & get the overview (always — cheap and orienting)
Never start by scrolling packets. Get the shape of the capture first:
- Protocol hierarchy — what protocols are even present, and in what proportion.
- Conversations / endpoints — who talked to whom, and the heavy talkers.
- Capture duration and packet count — is this seconds or days?
The overview usually tells you where the answer lives. A capture that's 90% HTTP is a web
story; one with lots of DNS to one domain smells like tunneling; a burst of SYNs to many
ports is a scan. Let the overview pick your branch.

## 2. Form the hypothesis (say it out loud)
From the overview: "the interesting thing is probably X, because Y." E.g. "creds are probably in
that FTP conversation, because FTP is cleartext and there's a USER/PASS exchange." A hypothesis
turns 100k packets into one thing to check.

## 3. Follow the story (branch by task type)
- **Credentials** → isolate the cleartext-auth protocol (HTTP POST, FTP, Telnet, SMTP, POP,
  IMAP, SNMP community strings) and read the auth exchange. Follow the specific stream.
- **File recovery** → export objects (HTTP/SMB/TFTP/FTP-DATA), or follow the transfer stream and
  save the raw bytes, then `file`/`binwalk` them. Carved file → hand to /steg if it's hiding more.
- **Attack reconstruction** → look at timing and volume: many SYNs = port scan; repeated logins =
  brute force; a shell-looking stream = exploitation/C2. Build a timeline of what happened when.
- **Forensic questions** → answer each precisely from filters (host count from unique IPs, OS from
  TTL/User-Agent, first/last timestamps, etc.).
- **Covert channel / exfil** → DNS with long/odd subdomains = DNS tunneling; ICMP with payloads =
  ICMP exfil; decode the encoded data (often base32/base64/hex in the query names or payloads).

## 4. Decrypt if needed
- TLS/HTTPS is opaque without keys. If the room provides an RSA key or an SSLKEYLOGFILE, load it
  (tshark `-o tls.keylog_file:<path>` or the RSA key) — otherwise the payloads stay encrypted and
  you work from metadata (SNI, cert, sizes, timing) instead.
- WPA/802.11 captures: if given the passphrase, decrypt to read the traffic inside.

## 5. Extract & stop
Pull the specific answer the task named (cred, file, IP, count, decoded string). Record it in
notes.md. If the goal is met, stop — capture rooms rarely need anything after the answer.

## Rules
- Overview before packets, always. Scrolling raw packets without the shape of the capture is the
  #1 time-sink.
- Match the technique to the protocol the overview surfaced — don't grep the whole capture blindly.
- The answer is *in the capture* — you're reading, not exploiting. If you're reaching for attack
  tools on a pcap room, you've misclassified it.
- Cleartext protocols (FTP/Telnet/HTTP/SNMP) are where creds hide; encrypted ones need keys.