Network Forensics and Full Packet Capture in the Home Lab

This step guides you through deploying full packet capture and network forensics tools in your home lab. You’ll learn how to collect, store, and analyze network traffic for deep investigation of security incidents.

Prerequisites

• Completed Incident Response Automation
• Suricata or other IDS/IPS sensors deployed

What is Network Forensics?

Network forensics is the process of capturing, recording, and analyzing network traffic to investigate security incidents, reconstruct events, and gather evidence.

Lab Architecture

[Suricata/IDS] → [Packet Capture Appliance] → [Storage/Analysis Workstation]

Step 1: Deploying Full Packet Capture

Tool Options

• tcpdump: Lightweight CLI packet capture
• Wireshark: GUI-based analysis and capture
• Arkime (formerly Moloch): Scalable, searchable packet capture platform
• Security Onion: Integrated NSM and forensics distro

Example: tcpdump Setup

# Capture all traffic on eth0 and write to file
sudo tcpdump -i eth0 -w /data/captures/lab-traffic.pcap

# Capture only suspicious traffic (e.g., port 22)
sudo tcpdump -i eth0 port 22 -w /data/captures/ssh-traffic.pcap

Example: Arkime Deployment (Docker)

git clone https://github.com/arkime/arkime.git
cd arkime/docker
docker compose up -d

• Access Arkime UI at http://localhost:8005

Step 2: Storage and Retention

• Use dedicated storage for large pcap files
• Implement log rotation and retention policies
• Compress old captures to save space

Step 3: Traffic Analysis

Wireshark Basics

• Open pcap files for protocol and payload inspection
• Use filters (e.g., http, tcp.port==22, dns) to focus analysis
• Follow TCP streams to reconstruct sessions

Arkime Features

• Search and index captured packets
• Tag and export evidence for investigations
• Integrate with Suricata EVE logs for context

Step 4: Incident Investigation Workflow

1. Identify: Use IDS alerts to pinpoint suspicious timeframes
2. Extract: Filter and export relevant packets
3. Analyze: Reconstruct sessions, decode payloads, and review metadata
4. Document: Save findings and evidence for reporting

Step 5: Automation and Integration

• Schedule regular packet captures with cron or systemd timers
• Integrate with SIEM for alert-driven capture triggers
• Use scripts to automate extraction and analysis

Security and Privacy Considerations

• Limit access to packet capture data
• Encrypt stored pcap files
• Regularly purge old or unnecessary captures

Maintenance Tasks

• Monitor disk usage and rotate captures
• Update analysis tools and signatures
• Review retention and access policies

---

Continue your home lab journey with advanced threat hunting and custom detection workflows.