Network Forensics Tools

Yes, much as I dislike this abuse of the word “Forensics” (see Rant), I’ll recognize that it is a very popular abuse.

Chaosreader, jpcap, Microsoft Log Parser can break up a packet capture (pcap) file (created by Wireshark or Microsoft Net Monitor) into manageable components (including downloaded files). See the Network Forensics Puzzle site for more tools.

Palo Alto Networks enterprise firewall, in Tap Mode, can interpret http traffic, parse documents in the traffic, identify P2P applications tunneled over http (such as Skype), and correlate the traffic with a user (not just an IP address).

Net Witness (derived from the retired FBI Carnivore program), monitors network traffic for email and Internet traffic. A free version parses pcap files up to 1 GB.

Spector monitors Internet activity.

Solera Networks offers products and their “What is Network Forensics?” whitepaper.