Network forensics - Documentation

Omnipeek User Guide

Introduction
Using Capture Engines with Omnipeek
The Capture Window
Dashboards
Viewing and Decoding Packets
Creating and Using Filters
Post-capture Analysis
- About post-capture analysis
  Network forensics
- Saving packets
- Copying selected packets to a new window
- Hiding and unhiding packets
- Selecting related packets
- Label selected packets
- Finding strings in packets
- Selecting packets matching user-defined criteria
- Forensic search from the Files tab
- Forensic search from the Forensics tab
- Forensic search from the ‘Forensics Capture’ window
- Using the Distributed Forensic Search wizard
Expert Analysis
Multi-Segment Analysis
Web Analysis
Voice & Video Analysis
Displaying and Reporting Statistics
Using the Peer Map
Creating Graphs
Setting Alarms and Triggers
Sending Notifications
Using the Name Table
Viewing Logs and Events
Applying Analysis Modules
Configuring Options
Capturing Data for Wireless Analysis
Configuring capture adapters
Omnipeek Remote Assistant
Global Positioning System
Menus and Keyboard Shortcuts
Reference
Analysis Modules
Expert Events
Real-World Security Investigations
Connecting to a Capture Engine

Omnipeek: Omnipeek User GuideDownload PDF

Post-capture Analysis : About post-capture analysis : Network forensics

Network forensics

Network forensics is the retrospective analysis of network traffic for the purpose of conducting an investigation. See the following sections for information on how to use Omnipeek in different ways to perform network forensics on your own network.

• Forensic search from the Files tab

• Forensic search from the Forensics tab

• Forensic search from the ‘Forensics Capture’ window

Post-capture Analysis Saving packets