Hack the Route Start free Open app Detection and response
Packet forensics
Reconstructing an incident after the fact from a saved packet capture of the traffic.
A capture file is a faithful recording of what crossed the wire, so everything done over the network is in it.
Tools like tcpdump -r and tshark read it back: conversations and endpoints show who talked to whom, display
filters and field extraction pull out requests and headers, following a TCP stream recovers cleartext payloads, and
object export rebuilds transferred files. The work is turning raw packets into who, when, what was taken, and the
indicators to hunt elsewhere.