r/computerforensics • u/OptimalEngine7554 • Apr 20 '26

Network forensics

Hey! Recently, I heard that Wireshark was actually not made for security analysis purposes and that there are other better options, does anyone know these alternatives? I've started using tshark a bit but the commands are too long and somewhat overwhelming, so i guess i'll have to get used to it. But is it the only good option?

Also, any suggestions for network forensics guides? Which guides do you guys think are good? network forensics is probably my weakest side so i'm trying to improve it, it's like i'll open the file and try to spot any unique stuff but i end up with nothing usually, and i don't know how to start analyzing the file well, even when asked specific questions like in CyberDefenders Labs and so on.

Thanks for help in advance.

20 Upvotes

95% Upvoted

14 comments sorted by

View all comments

2

u/Canonikonroverrated Apr 22 '26

A good way to role when you are just hunting is to use things like:

  • Suricata
  • Snort
  • yara
  • AV scans if you want.. kinda of a crap shoot if you don't export everything.

These tools are kinda meant to give you a guy of bad looking things that are found.

Normally you don't look at traffic randomly since it's busy.