Technical Procedures
Network Traffic Analysis for Incident Response
Guide for using network traffic analysis to support incident investigation and threat hunting.
Technical Procedures · intermediate · 2-4 hours
Procedures for capturing and analyzing network traffic during security incidents.
Steps
5
01
Capture Planning
Plan network traffic capture strategy.
- Identify key network segments to monitor
- Ensure legal authorization for capture
- Select appropriate capture tools
- Plan storage for captured data
Wireshark · tcpdump · Zeek · Network TAP/SPAN
02
Traffic Capture
Capture relevant network traffic.
- Start capture with appropriate filters
- Monitor capture file size
- Rotate files as needed
- Preserve original capture files
03
Initial Analysis
Perform initial traffic analysis.
- Review protocol statistics
- Identify top talkers and connections
- Look for unusual ports or protocols
- Filter for specific indicators
04
Deep Analysis
Investigate suspicious traffic.
- Follow TCP streams for suspicious connections
- Extract files transferred over network
- Analyze DNS queries for C2 indicators
- Check for data exfiltration patterns
05
Documentation
Document analysis findings.
- Export relevant packet captures
- Document IOCs found in traffic
- Create timeline of network events
- Write analysis summary
Checklist
- Capture authorization obtained
- Capture tools prepared
- Traffic successfully captured
- Protocol statistics reviewed
- Suspicious connections identified
- Streams analyzed
- Files extracted (if applicable)
- IOCs documented
- Findings summarized
Evidence
- PCAP files
- Extracted files
- IOC list
- Analysis notes
- Connection timeline