PASSIVE METHODS FOR NETWORK FORENSICS AND DEEP PACKET INSPECTION (DPI) IN LOCAL AREA NETWORKS: PASSIVE METHODS FOR NETWORK FORENSICS AND DEEP PACKET INSPECTION (DPI) IN LOCAL AREA NETWORKS

Denis Zvezdelinov; Zdravko Kuzmanov

doi:10.46687/jsar.v30i1.489

Authors

Denis Zvezdelinov Department of Communication and Computer Engineering and Security Technologies, Faculty of Technical Sciences, Konstantin Preslavsky University of Shumen, Shumen 9712, 115 Universitetska St., e-mail: d.zvezdelinov@shu.bg
Zdravko Kuzmanov Department of Communication and Computer Engineering and Security Technologies, Konstantin Preslavsky University of Shumen, Shumen 9712, 115 Universitetska St., e-mail: z.kuzmanov@shu.bg

DOI:

https://doi.org/10.46687/jsar.v30i1.489

Keywords:

Network forensics, Deep Packet Inspection (DPI), Full Packet Capture, pcap, Wireshark, Tcpdump, Reassembly of sessions

Abstract

Network forensics is a critical element of the modern cybersecurity incident investigation process. Unlike active scanning methods, passive analysis enables the extraction of evidentiary material without modifying network traffic and without the risk of exposing the analysis station. This report examines the application of passive Deep Packet Inspection (DPI) methods within Local Area Network (LAN) environments. The focus is placed on the technological framework for Full Packet Capture (FPC), the chronological reassembly of TCP/IP sessions, and the decoding of transport and application-layer protocol structures. By utilizing open-source software tools (tcpdump, Wireshark, TShark), the full cycle of forensic analysis is demonstrated – ranging from the generation of raw .pcap datasets to the extraction of Indicators of Compromise (IoCs) and the reconstruction of transferred files. The report outlines key methodological recommendations for preserving the integrity of digital evidence and analyzes the challenges arising from the widespread adoption of encrypted protocols (TLS/HTTPS).

Author Biographies

Denis Zvezdelinov, Department of Communication and Computer Engineering and Security Technologies, Faculty of Technical Sciences, Konstantin Preslavsky University of Shumen, Shumen 9712, 115 Universitetska St., e-mail: d.zvezdelinov@shu.bg

Department of Communication and Computer Engineering and Security Technologies, Faculty of Technical Sciences, Konstantin Preslavsky University of Shumen, Shumen 9712, 115 Universitetska St., e-mail: d.zvezdelinov@shu.bg

Zdravko Kuzmanov, Department of Communication and Computer Engineering and Security Technologies, Konstantin Preslavsky University of Shumen, Shumen 9712, 115 Universitetska St., e-mail: z.kuzmanov@shu.bg

Department of Communication and Computer Engineering and Security Technologies, Konstantin Preslavsky University of Shumen, Shumen 9712, 115 Universitetska St., e-mail: z.kuzmanov@shu.bg

References

Bejtlich, R. (2013). The Practice of Network Security Monitoring: Understanding Incident Detection and Response. San Francisco.

Davidoff, S., & Ham, J. (2012). Network Forensics: Tracking Hackers Through Cyberspace. New Jersey.

Hoffman, P., & McManus, P. (2018). DNS Queries over HTTPS (DoH). RFC 8484, Internet Engineering Task Force (IETF).

Iyengar, J., & Thomson, M. (2021). QUIC: A UDP-Based Multiplexed and Secure Transport. RFC 9000, Internet Engineering Task Force (IETF).

Rescorla, E. (2018). The Transport Layer Security (TLS) Protocol Version 1.3. RFC 8446, Internet Engineering Task Force (IETF).

Sanders, C. (2017). Practical Packet Analysis: Using Wireshark to Solve Real-World Network Problems (3rd ed.). San Francisco

Tcpdump Group. (2023). Tcpdump/Libpcap Official Documentation. [Online]. Available: https://www.tcpdump.org/

Althouse, J., Atkinson, J., & Brady, J. (2017). JA3 - A method for profiling SSL/TLS Clients. Salesforce Engineering. [Online]. Available:

https://engineering.salesforce.com/tls-fingerprinting-with-ja3-and-ja3s-24736285ea35/

Elitsa Kuzmanova, Donika Dimanova, Technical privacy risks in Generative AI (GenAI) – Lessons from OWASP and Real-World Failures, 10th International Conference on Energy Efficiency and Agricultural Engineering (EE&AE 2025), 5-7 November 2025, Starozagorski Bani, Bulgaria, 979-8-3315-1299-6/2025 IEEE. [Online]. Available:

https://doi.org/10.1109/EEAE65901.2025.11273791.

Wireshark Foundation. (2023). PCAP Next Generation (pcapng) Capture File Format. [Online]. Available: https://www.wireshark.org/ / https://tshark.dev/.

PASSIVE METHODS FOR NETWORK FORENSICS AND DEEP PACKET INSPECTION (DPI) IN LOCAL AREA NETWORKS