Source of network evidence

Network evidence can be collected from a variety of sources and we will discuss these sources in the next section. The sources that we will be discussing are:

• Tapping the wire and the air
• CAM table on a network switch
• Routing tables on routers
• Dynamic Host Configuration Protocol logs
• DNS server logs
• Domain controller/ authentication servers/ system logs
• IDS/IPS logs
• Firewall logs
• Proxy Server logs

Tapping the wire and the air

One of the purest and most raw forms of information capture is to put taps on network and optical fiber cables to snoop on traffic.

 Many commercial vendors provide network taps and SPAN ports on their devices for snooping...