NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a lab♥ Codelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us
[>_] ROOM · Forensics
Network Forensics Fundamentals
Master the basics of network forensics, PCAP analysis, and traffic capture using industry-standard tools like Wireshark and tcpdump.
Room tasks
1What Is Network Forensics and Why Does It Matter
2Full Packet Capture vs Flow Data
3Guided Lab: Capturing Traffic for Investigation
Frequently Asked Questions
What is network forensics?
Network forensics captures and analyses network traffic and logs to investigate incidents. It shows who talked to whom, what was sent and when, even when endpoints are unavailable.
What is a PCAP file?
A PCAP is a recording of packets captured from a network. Analysts open it in tools like Wireshark to inspect conversations, protocols and any data that was sent in the clear.
What is the difference between tcpdump and Wireshark?
Tcpdump is a command-line packet capture tool, while Wireshark offers a graphical interface for deep inspection. This free Codelivly room teaches both for investigating incidents.