# Network Forensics Fundamentals

> Master the basics of network forensics, PCAP analysis, and traffic capture using industry-standard tools like Wireshark and tcpdump.

Canonical: https://codelivly.com/rooms/network-forensics-fundamentals
Last updated: 2026-09-13

| | |
|---|---|
| Level | Intermediate |
| Category | Forensics |
| Lessons | 3 |
| Estimated time | 30 min |
| XP | 100 |

This module introduces the foundational concepts of network forensics in digital investigations. You will learn why network traffic is a critical source of volatile evidence, understand the differences between PCAP and PCAPNG formats, and master the basics of capturing and preserving network traffic. Key topics include configuring capture methods (SPAN ports, network TAPs), using tcpdump for command-line acquisition, and performing initial triage with Wireshark. From a cybersecurity perspective, understanding these basics is essential before attempting deep packet analysis, as improper capture or handling can destroy critical metadata and break the chain of custody.

## Lessons

1. What Is Network Forensics and Why Does It Matter (30 min)
2. Full Packet Capture vs Flow Data (30 min)
3. Guided Lab: Capturing Traffic for Investigation (30 min)

## Related

- [Learning path: Network Forensics](https://codelivly.com/learning-paths/network-forensics)
- [All rooms](https://codelivly.com/rooms)