Comparative Analysis of Network Forensic Tools and Network Forensics Processes

TL;DR

This paper compares four popular network forensic tools to evaluate their capabilities in incident detection, collection, and analysis, highlighting Xplico as the most comprehensive among them.

Contribution

It provides a comparative analysis of four well-known network forensic tools, emphasizing their functionalities and effectiveness in network incident analysis.

Findings

Xplico outperforms other tools in incident identification and analysis

Differences exist in roles and functionalities of various NFTs

The study aids in selecting appropriate forensic tools for network security

Abstract

Network Forensics (NFs) is a branch of digital forensics which used to detect and capture potential digital crimes over computer networked environments crime. Network Forensic Tools (NFTs) and Network Forensic Processes (NFPs) have abilities to examine networks, collect all normal and abnormal traffic/data, help in network incident analysis, and assist in creating an appropriate incident detection and reaction and also create a forensic hypothesis that can be used in a court of law. Also, it assists in examining the internal incidents and exploitation of assets, attack goals, executes threat evaluation, also by evaluating network performance. According to existing literature, there exist quite a number of NFTs and NTPs that are used for identification, collection, reconstruction, and analysing the chain of incidents that happen on networks. However, they were vary and differ in their roles and functionalities. The main objective of this paper, therefore, is to assess and see the distinction that exist between Network Forensic Tools (NFTs) and Network Forensic Processes (NFPs). Precisely, this paper focuses on comparing among four famous NFTs: Xplico, OmniPeek, NetDetector, and NetIetercept. The outputs of this paper show that the Xplico tool has abilities to identify, collect, reconstruct, and analyse the chain of incidents that happen on networks than other NF tools.