CHFI (312-49) Digital Forensics Simulation
Investigation Scenario
A mid-sized e-commerce company experienced a catastrophic drop in web server availability during a critical sales event. The incident response team captured full PCAP (Packet Capture) files and Zeek network flow logs at the perimeter firewall during the degradation window.
As the lead digital forensics investigator, you are tasked with examining the network traffic to determine if the outage was caused by a configuration error, a hardware failure, or an intentional Denial of Service (DoS) attack. You load the network captures into your analysis tools to identify statistical anomalies.
Evidence Collected
You extract a snippet of the connection logs (`conn.log`) aggregated by Zeek during the first minute of the outage. Review the flow metrics below:
Question
In a network-forensics investigation, an analyst is using a tool to capture network traffic and identify potential "Denial of Service" (DoS) attacks. Which metric should the analyst monitor to detect a DoS attack?
Expert Analysis
1. What the Evidence Shows
The Zeek conn.log excerpt reveals a massive statistical anomaly. Over 125,000 packets per second (orig_pkts) are originating from a single IP address (198.51.100.45) targeting the web server (203.0.113.80) on port 80. The conn_state of S0 (Connection attempt seen, no reply) strongly suggests a TCP SYN flood attack intended to exhaust the server's connection state table.
2. Identify Forensic Stage
Analysis (Network Traffic Examination). The investigator has collected the PCAP/Flow data and is currently analyzing network metrics to ascertain the methodology and scale of the resource exhaustion attack.
3. Why the Correct Answer is Correct (A)
A. Number of packets or bytes per second from a single source: Denial of Service (DoS) attacks rely on sheer volume to overwhelm a target's bandwidth, processing capacity, or state tables. Monitoring abrupt, sustained spikes in packets-per-second (pps) or bytes-per-second (Bps) from a single source (or multiple sources in a DDoS) to a specific destination is the primary forensic indicator of a volumetric or protocol-level DoS attack.
4. Why Others are Wrong
- B. Type of operating system: OS fingerprinting (via TTL, window size, etc.) helps profile an attacker or victim, but the OS type itself is not an indicator that a DoS attack is occurring.
- C. Number of open ports: Identifying open ports is part of vulnerability assessment and port scanning (e.g., Nmap). It describes the attack surface, not an active attack in progress.
- D. Geographical location: While IP geolocation is useful for attribution and blocking traffic post-identification, the origin location does not define whether the traffic is a DoS attack. A DoS is defined by volume and intent, regardless of geography.
5. Real-World Forensic Action
In a real-world scenario, upon identifying the anomalous packet-per-second rate, the forensic analyst would isolate the specific packets in Wireshark using a filter like ip.src == 198.51.100.45 && tcp.flags.syn == 1 && tcp.flags.ack == 0. They would document the exact bandwidth consumed, the duration of the attack, and export this data to substantiate the findings in the final incident report.
6. MINI LESSON: Network Forensics Flow Analysis
- PCAP vs. NetFlow: Full PCAPs are heavy and difficult to parse over long durations. Investigators often use NetFlow/Zeek logs first to spot statistical anomalies (like high PPS), then pivot to PCAPs for deep-packet inspection of the payload.
- Stateful Analysis: The
conn_statefield is crucial. A massive volume ofS0(SYN sent, no SYN-ACK received) orREJ(rejected) states highlights asymmetric traffic, typical in spoofed or exhaustion-based attacks. - Chain of Custody: Network captures must be hashed (e.g., SHA-256) immediately upon capture at the firewall or SPAN port to ensure they are admissible as evidence without claims of tampering.
Explore more CHFI simulations
Sharpen your digital forensics skills with more realistic scenarios.
View Practice Tests