Passive Methods for Network Forensics and Deep Packet Inspection (dpi) in Local Area Networks
Year: 2026
Type: article
Abstract: Network forensics is a critical element of the modern cybersecurity incident investigation process. Unlike active scanning methods, passive analysis enables the extraction of evidentiary material without modifying network traffic and without the risk of exposing the analysis station. This report examines the application of passive Deep Packet Inspection (DPI) methods within Local Area Network (LAN) environments. The focus is placed on the technological framework for Full Packet Capture (FPC), the chronological reassembly of TCP/IP sessions, and the decoding of transport and application-layer protocol structures. By utilizing open-source software tools (tcpdump, Wireshark, TShark), the full cycle of forensic analysis is demonstrated – ranging from the generation of raw .pcap datasets to the extraction of Indicators of Compromise (IoCs) and the reconstruction of transferred files. The report outlines key methodological recommendations for preserving the integrity of digital evidence and analyzes the challenges arising from the widespread adoption of encrypted protocols (TLS/HTTPS).
Authors: Denis Zvezdelinov, Zdravko Kuzmanov
Institution: Shumen University
Language: English
Topic: Digital and Cyber Forensics
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: diamond
OpenAlex ID: W7225319407