Advanced-Network-PCAP-Analyizer.sh

#!/bin/bash
# Advanced Network Forensics PCAP Analyzer
# Configuration
PCAP_FILE=$1
OUTPUT_DIR=$2
THREAT_INTEL_DB=$3
ENTROPY_THRESHOLD=5.0
DATE_TAG=$(date +%Y%m%d_%H%M%S)


if [ $# -lt 2 ]; then

echo "Usage: $0 [threat_intel_db]"/>/>/>/>

echo "Example: $0 suspicious.pcap /root/forensics_output
[/path/to/threat_intel.json]"

exit 1

fi


if [ ! -f "$PCAP_FILE" ]; then

echo "[-] Error: PCAP file not found!"

exit 1

fi


# Set up output directory
mkdir -p "$OUTPUT_DIR"
mkdir -p "$OUTPUT_DIR/artifacts"
mkdir -p "$OUTPUT_DIR/reports"
mkdir -p "$OUTPUT_DIR/extracted_files"
mkdir -p "$OUTPUT_DIR/sessions"
mkdir -p "$OUTPUT_DIR/logs"

# Log function with timestamps

log() {

echo "[$(date +%H:%M:%S)] $1" | tee -a "$OUTPUT_DIR/logs/forensics.log"

}

# Function to collect basic information about the PCAP

analyze_pcap_metadata() {

log "[+] Analyzing PCAP metadata..."



# Extract basic PCAP information

capinfos "$PCAP_FILE" > "$OUTPUT_DIR/reports/pcap_info.txt"



# Extract capture duration

START_TIME=$(capinfos "$PCAP_FILE" | grep "First packet time:" | cut -d: -f2- |
xargs)

END_TIME=$(capinfos "$PCAP_FILE" | grep "Last packet time:" | cut -d: -f2- |
xargs)

PACKETS=$(capinfos "$PCAP_FILE" | grep "Number of packets:" | cut -d: -f2 |
xargs)



log "[+] PCAP Info: $PACKETS packets from $START_TIME to $END_TIME"



# Create protocol hierarchy statistics

tshark -r "$PCAP_FILE" -q -z io,phs >
"$OUTPUT_DIR/reports/protocol_hierarchy.txt"



# Identify top talkers and conversations

tshark -r "$PCAP_FILE" -q -z endpoints,ip >
"$OUTPUT_DIR/reports/ip_endpoints.txt"

tshark -r "$PCAP_FILE" -q -z conv,ip >
"$OUTPUT_DIR/reports/ip_conversations.txt"

tshark -r "$PCAP_FILE" -q -z conv,tcp >
"$OUTPUT_DIR/reports/tcp_conversations.txt"

tshark -r "$PCAP_FILE" -q -z conv,udp >
"$OUTPUT_DIR/reports/udp_conversations.txt"



# Extract unique IP addresses and ports

tshark -r "$PCAP_FILE" -T fields -e ip.src | sort | uniq >
"$OUTPUT_DIR/artifacts/src_ips.txt"

tshark -r "$PCAP_FILE" -T fields -e ip.dst | sort | uniq >
"$OUTPUT_DIR/artifacts/dst_ips.txt"

tshark -r "$PCAP_FILE" -Y "tcp" -T fields -e tcp.dstport | sort | uniq -c | sort
-nr > "$OUTPUT_DIR/artifacts/tcp_ports.txt"

tshark -r "$PCAP_FILE" -Y "udp" -T fields -e udp.dstport | sort | uniq -c | sort
-nr > "$OUTPUT_DIR/artifacts/udp_ports.txt"



# Check geolocation of external IPs (requires geoiplookup)

if command -v geoiplookup &> /dev/null; then

log "[+] Performing geolocation analysis on external IPs..."



# Extract external IPs (non-RFC1918)

grep -v -E "^10\.|^172\.(1[6-9]|2[0-9]|3[0-1])\.|^192\.168\."
"$OUTPUT_DIR/artifacts/src_ips.txt" >
"$OUTPUT_DIR/artifacts/external_src_ips.txt"

grep -v -E "^10\.|^172\.(1[6-9]|2[0-9]|3[0-1])\.|^192\.168\."
"$OUTPUT_DIR/artifacts/dst_ips.txt" >
"$OUTPUT_DIR/artifacts/external_dst_ips.txt"



# Geolocate external IPs

touch "$OUTPUT_DIR/artifacts/ip_geolocations.txt"

for ip in $(cat "$OUTPUT_DIR/artifacts/external_src_ips.txt"
"$OUTPUT_DIR/artifacts/external_dst_ips.txt" | sort | uniq); do

geoiplookup "$ip" >> "$OUTPUT_DIR/artifacts/ip_geolocations.txt"

done

else

log "[-] geoiplookup not installed, skipping geolocation analysis"

fi



log "[+] PCAP metadata analysis complete"

}

# Function to detect protocol anomalies

detect_protocol_anomalies() {

log "[+] Detecting protocol anomalies..."



# HTTP on non-standard ports

tshark -r "$PCAP_FILE" -Y "http.request and tcp.port != 80 and tcp.port != 8080
and tcp.port != 443" -T fields -e ip.src -e ip.dst -e tcp.dstport -e
http.request.uri > "$OUTPUT_DIR/artifacts/http_nonstandard_ports.txt"



# DNS on non-standard ports

tshark -r "$PCAP_FILE" -Y "dns and tcp.port != 53 and udp.port != 53" -T fields
-e ip.src -e ip.dst -e udp.dstport -e tcp.dstport -e dns.qry.name >
"$OUTPUT_DIR/artifacts/dns_nonstandard_ports.txt"



# Detect HTTP traffic when it should be HTTPS

tshark -r "$PCAP_FILE" -Y "http.request.uri contains \"login\" or
http.request.uri contains \"auth\" or http.request.uri contains \"password\" and
not ssl" -T fields -e ip.src -e ip.dst -e tcp.dstport -e http.request.uri >
"$OUTPUT_DIR/artifacts/cleartext_auth_http.txt"



# TLS certificate anomalies

tshark -r "$PCAP_FILE" -Y "ssl.handshake.certificate" -T fields -e ip.src -e
ip.dst -e x509sat.uTF8String -e x509sat.printableString -e
"x509sat.universalString" -e x509sat.ia5String >
"$OUTPUT_DIR/artifacts/ssl_certificates.txt"



# Detect self-signed certificates

tshark -r "$PCAP_FILE" -Y "ssl.handshake.certificate and x509af.issuer ==
x509af.subject" -T fields -e ip.src -e ip.dst -e x509sat.uTF8String >
"$OUTPUT_DIR/artifacts/self_signed_certs.txt"



# SMB traffic outside local network

tshark -r "$PCAP_FILE" -Y "(smb or smb2) and not (ip.src == 192.168.0.0/16 and
ip.dst == 192.168.0.0/16) and not (ip.src == 10.0.0.0/8 and ip.dst ==
10.0.0.0/8) and not (ip.src == 172.16.0.0/12 and ip.dst == 172.16.0.0/12)" -T
fields -e ip.src -e ip.dst > "$OUTPUT_DIR/artifacts/external_smb.txt"



# SSH traffic to unusual ports

tshark -r "$PCAP_FILE" -Y "ssh and tcp.dstport != 22" -T fields -e ip.src -e
ip.dst -e tcp.dstport > "$OUTPUT_DIR/artifacts/ssh_nonstandard_ports.txt"



# Check for suspicious TLS versions (less than TLS 1.2)

tshark -r "$PCAP_FILE" -Y "ssl.handshake.version < 0x0303" -T fields -e ip.src
-e ip.dst -e ssl.handshake.version >
"$OUTPUT_DIR/artifacts/old_tls_versions.txt"



# JA3 fingerprinting (finding uncommon TLS client fingerprints)

tshark -r "$PCAP_FILE" -Y "ssl.handshake.type == 1" -T fields -e ip.src -e
tcp.srcport -e ip.dst -e tcp.dstport -e ssl.handshake.ja3 >
"$OUTPUT_DIR/artifacts/ja3_hashes.txt"



# Generate port scanning detection

tshark -r "$PCAP_FILE" -Y "tcp.flags == 0x0002 or tcp.flags.syn == 1" -T fields
-e ip.src -e ip.dst -e tcp.dstport | sort | uniq -c | sort -nr >
"$OUTPUT_DIR/artifacts/possible_port_scans.txt"



# Check for non-compliant DNS responses

tshark -r "$PCAP_FILE" -Y "dns.flags.response == 1 and dns.qry.name contains
\".\" and not dns.resp.name contains \".\"" -T fields -e ip.src -e ip.dst -e
dns.qry.name -e dns.resp.name > "$OUTPUT_DIR/artifacts/dns_anomalies.txt"



# ICMP anomalies (oversized ICMP packets that could indicate tunneling)

tshark -r "$PCAP_FILE" -Y "icmp and data.len > 56" -T fields -e ip.src -e ip.dst
-e icmp.type -e data.len > "$OUTPUT_DIR/artifacts/oversized_icmp.txt"



# Check for DNS record types often used in DNS tunneling

tshark -r "$PCAP_FILE" -Y "dns.qry.type == 16 or dns.qry.type == 28 or
dns.qry.type == 33" -T fields -e ip.src -e ip.dst -e dns.qry.name -e
dns.qry.type > "$OUTPUT_DIR/artifacts/dns_unusual_types.txt"



# Look for unusually large DNS queries (potential exfiltration)

tshark -r "$PCAP_FILE" -Y "dns.qry.name" -T fields -e dns.qry.name | awk '{print
length($0), $0}' | sort -nr | head -50 >
"$OUTPUT_DIR/artifacts/long_dns_queries.txt"



# Entropy analysis of DNS queries (high entropy could indicate encoding)

tshark -r "$PCAP_FILE" -Y "dns.qry.name" -T fields -e dns.qry.name | python3 -c
'

import sys

import math

import collections

def entropy(data):

if not data:

return 0

entropy = 0

for x in range(256):

p_x = float(data.count(chr(x)))/len(data)

if p_x > 0:

entropy += - p_x * math.log2(p_x)

return entropy

for line in sys.stdin:

line = line.strip()

if len(line) > 15: # Only check domains of sufficient length

e = entropy(line.split(".")[0]) # Check entropy of domain part before TLD

if e > 4.0:

print(f"{e:.2f} - {line}")

' > "$OUTPUT_DIR/artifacts/high_entropy_dns.txt"



log "[+] Protocol anomaly detection complete"

}

# Function to extract network artifacts

extract_network_artifacts() {

log "[+] Extracting network artifacts..."



# Extract files from various protocols

mkdir -p "$OUTPUT_DIR/extracted_files/http"

mkdir -p "$OUTPUT_DIR/extracted_files/ftp"

mkdir -p "$OUTPUT_DIR/extracted_files/smb"

mkdir -p "$OUTPUT_DIR/extracted_files/tftp"



# HTTP objects

log "[+] Extracting HTTP objects..."

tshark -r "$PCAP_FILE" --export-objects http,"$OUTPUT_DIR/extracted_files/http"
> /dev/null 2>&1



# FTP artifacts

log "[+] Extracting FTP artifacts..."

tshark -r "$PCAP_FILE" -Y "ftp" -T fields -e tcp.stream >
"$OUTPUT_DIR/artifacts/ftp_streams.txt"

if [ -s "$OUTPUT_DIR/artifacts/ftp_streams.txt" ]; then

for stream in $(cat "$OUTPUT_DIR/artifacts/ftp_streams.txt" | sort -u); do

tshark -r "$PCAP_FILE" -q -z "follow,tcp,ascii,$stream" >
"$OUTPUT_DIR/sessions/ftp_session_$stream.txt"

done

fi



# SMB file transfers

log "[+] Extracting SMB artifacts..."

tshark -r "$PCAP_FILE" --export-objects smb,"$OUTPUT_DIR/extracted_files/smb" >
/dev/null 2>&1



# TFTP file transfers

log "[+] Extracting TFTP artifacts..."

tshark -r "$PCAP_FILE" --export-objects tftp,"$OUTPUT_DIR/extracted_files/tftp"
> /dev/null 2>&1



# Extract email artifacts

mkdir -p "$OUTPUT_DIR/extracted_files/email"

log "[+] Extracting email artifacts..."

tshark -r "$PCAP_FILE" -Y "smtp or pop or imap" -T fields -e tcp.stream >
"$OUTPUT_DIR/artifacts/email_streams.txt"

if [ -s "$OUTPUT_DIR/artifacts/email_streams.txt" ]; then

for stream in $(cat "$OUTPUT_DIR/artifacts/email_streams.txt" | sort -u); do

tshark -r "$PCAP_FILE" -q -z "follow,tcp,ascii,$stream" >
"$OUTPUT_DIR/extracted_files/email/email_session_$stream.txt"

done

fi



# Extract all URLs from HTTP streams

log "[+] Extracting URLs..."

tshark -r "$PCAP_FILE" -Y "http" -T fields -e http.request.full_uri | sort |
uniq > "$OUTPUT_DIR/artifacts/http_urls.txt"



# Extract all domains from DNS queries

log "[+] Extracting DNS queries..."

tshark -r "$PCAP_FILE" -Y "dns" -T fields -e dns.qry.name | sort | uniq >
"$OUTPUT_DIR/artifacts/dns_queries.txt"



# Extract all email addresses

log "[+] Extracting email addresses..."

tshark -r "$PCAP_FILE" -Y "smtp or pop or imap" -T fields -e tcp.stream >
"$OUTPUT_DIR/artifacts/email_streams.txt"

if [ -s "$OUTPUT_DIR/artifacts/email_streams.txt" ]; then

for stream in $(cat "$OUTPUT_DIR/artifacts/email_streams.txt" | sort -u); do

tshark -r "$PCAP_FILE" -q -z "follow,tcp,ascii,$stream" | grep -Eo
"[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,6}" | sort | uniq >>
"$OUTPUT_DIR/artifacts/email_addresses.txt"

done



if [ -f "$OUTPUT_DIR/artifacts/email_addresses.txt" ]; then

sort -u "$OUTPUT_DIR/artifacts/email_addresses.txt" -o
"$OUTPUT_DIR/artifacts/email_addresses.txt"

fi

fi



# Extract all user-agents

log "[+] Extracting HTTP User-Agents..."

tshark -r "$PCAP_FILE" -Y "http.user_agent" -T fields -e http.user_agent | sort
| uniq -c | sort -nr > "$OUTPUT_DIR/artifacts/http_user_agents.txt"



# Extract hostnames

log "[+] Extracting hostnames..."

tshark -r "$PCAP_FILE" -Y "http.host" -T fields -e http.host | sort | uniq >
"$OUTPUT_DIR/artifacts/http_hosts.txt"



# Extract POST data from HTTP sessions

log "[+] Extracting HTTP POST data..."

tshark -r "$PCAP_FILE" -Y "http.request.method == \"POST\"" -T fields -e
tcp.stream > "$OUTPUT_DIR/artifacts/http_post_streams.txt"

if [ -s "$OUTPUT_DIR/artifacts/http_post_streams.txt" ]; then

for stream in $(cat "$OUTPUT_DIR/artifacts/http_post_streams.txt" | sort -u); do

tshark -r "$PCAP_FILE" -q -z "follow,tcp,ascii,$stream" >
"$OUTPUT_DIR/sessions/http_post_$stream.txt"

done

fi



# Extract all IP addresses that communicated with domains/IPs on a watch list
(if provided)

if [ -n "$THREAT_INTEL_DB" ] && [ -f "$THREAT_INTEL_DB" ]; then

log "[+] Correlating with threat intelligence database..."



# Assuming the threat intel DB has one domain/IP per line

mkdir -p "$OUTPUT_DIR/artifacts/threat_matches"



# Check DNS queries against threat intel

for domain in $(cat "$OUTPUT_DIR/artifacts/dns_queries.txt"); do

if grep -q "$domain" "$THREAT_INTEL_DB"; then

log "[!] Found suspicious domain: $domain"

tshark -r "$PCAP_FILE" -Y "dns.qry.name == \"$domain\"" -T fields -e frame.time
-e ip.src -e ip.dst -e dns.qry.name >
"$OUTPUT_DIR/artifacts/threat_matches/domain_$domain.txt"

fi

done



# Check IP addresses against threat intel

for ip in $(cat "$OUTPUT_DIR/artifacts/src_ips.txt"
"$OUTPUT_DIR/artifacts/dst_ips.txt" | sort | uniq); do

if grep -q "$ip" "$THREAT_INTEL_DB"; then

log "[!] Found suspicious IP: $ip"

tshark -r "$PCAP_FILE" -Y "ip.addr == $ip" -T fields -e frame.time -e ip.src -e
ip.dst -e tcp.srcport -e tcp.dstport -e udp.srcport -e udp.dstport >
"$OUTPUT_DIR/artifacts/threat_matches/ip_$ip.txt"

fi

done

fi



log "[+] Network artifact extraction complete"

}

# Function to detect data exfiltration

detect_data_exfiltration() {

log "[+] Detecting potential data exfiltration..."



# Look for large file transfers

log "[+] Identifying large file transfers..."

tshark -r "$PCAP_FILE" -Y "tcp.len > 1000" -T fields -e ip.src -e ip.dst -e
tcp.len -e frame.protocols | \

awk '{sum[$1"->"$2] += $3} END {for (i in sum) print sum[i], i}' | sort -nr >
"$OUTPUT_DIR/artifacts/large_transfers.txt"



# DNS exfiltration - unusually long or high volume DNS queries

log "[+] Checking for DNS exfiltration patterns..."

tshark -r "$PCAP_FILE" -Y "dns.qry.name" -T fields -e ip.src -e dns.qry.name | \

awk '{len=length($2); sum[$1] += len; count[$1]++} END {for (i in sum) print
sum[i], count[i], sum[i]/count[i], i}' | sort -nr >
"$OUTPUT_DIR/artifacts/dns_volume_per_host.txt"



# Look for domain names containing base64-encoded strings

log "[+] Looking for encoded DNS queries..."

tshark -r "$PCAP_FILE" -Y "dns.qry.name" -T fields -e dns.qry.name | grep -E
'[A-Za-z0-9+/]{20,}={0,2}' > "$OUTPUT_DIR/artifacts/base64_dns.txt"



# Identify periodic beaconing (potential C2)

log "[+] Identifying potential beaconing patterns..."

tshark -r "$PCAP_FILE" -Y "tcp.flags == 0x0002" -T fields -e frame.time_epoch -e
ip.src -e ip.dst -e tcp.dstport | python3 -c '

import sys

import collections

import statistics

connections = collections.defaultdict(list)

for line in sys.stdin:

parts = line.strip().split()

if len(parts) >= 4:

time = float(parts[0])

src = parts[1]

dst = parts[2]

port = parts[3]

connections[(src, dst, port)].append(time)

print("Source,Destination,Port,Count,Mean Interval,StdDev,Regularity Score")

for (src, dst, port), times in connections.items():

if len(times) >= 3: # Need at least 3 points to detect a pattern

times.sort()

intervals = [times[i+1] - times[i] for i in range(len(times)-1)]



if intervals:

mean_interval = sum(intervals) / len(intervals)



if len(intervals) > 1:

stddev = statistics.stdev(intervals)

# Lower ratio indicates more regular timing (potential beaconing)

regularity = stddev / mean_interval if mean_interval > 0 else 999

else:

stddev = 0

regularity = 999



# Only show results with decent regularity and multiple occurrences

if regularity < 0.3 and len(times) >= 3:

print(f"{src},{dst},{port},{len(times)},{mean_interval:.2f},{stddev:.2f},{regularity:.4f}")

' > "$OUTPUT_DIR/artifacts/beaconing_patterns.csv"



# Look for unusual data in ICMP packets (potential tunneling)

log "[+] Checking for ICMP tunneling..."

tshark -r "$PCAP_FILE" -Y "icmp and data.len > 56" -w
"$OUTPUT_DIR/artifacts/icmp_with_data.pcap"



# Create summary of potential exfiltration methods found

{

echo "=== Potential Data Exfiltration Summary ==="

echo ""



echo "Top 10 Largest Data Transfers:"

head -10 "$OUTPUT_DIR/artifacts/large_transfers.txt"

echo ""



echo "Hosts with Highest DNS Query Volume:"

head -10 "$OUTPUT_DIR/artifacts/dns_volume_per_host.txt"

echo ""



if [ -s "$OUTPUT_DIR/artifacts/base64_dns.txt" ]; then

echo "Base64-encoded DNS Queries Detected:"

head -10 "$OUTPUT_DIR/artifacts/base64_dns.txt"

echo "Total Encoded Queries: $(wc -l < "$OUTPUT_DIR/artifacts/base64_dns.txt")"

echo ""

else

echo "No Base64-encoded DNS Queries Detected"

echo ""

fi



if [ -s "$OUTPUT_DIR/artifacts/beaconing_patterns.csv" ]; then

echo "Potential Beaconing Patterns (C2 Communication):"

cat "$OUTPUT_DIR/artifacts/beaconing_patterns.csv"

echo ""

else

echo "No Regular Beaconing Patterns Detected"

echo ""

fi



if [ -s "$OUTPUT_DIR/artifacts/oversized_icmp.txt" ]; then

echo "Oversized ICMP Packets (Potential Tunneling):"

cat "$OUTPUT_DIR/artifacts/oversized_icmp.txt"

echo ""

else

echo "No Oversized ICMP Packets Detected"

echo ""

fi

} > "$OUTPUT_DIR/reports/exfiltration_summary.txt"



log "[+] Data exfiltration detection complete"

}

# Function to detect tunneled protocols and covert channels

detect_tunneled_protocols() {

log "[+] Detecting tunneled protocols and covert channels..."



# HTTP(S) Tunneling Detection

log "[+] Checking for HTTP(S) tunneling..."

tshark -r "$PCAP_FILE" -Y "http.request.method == \"CONNECT\"" -T fields -e
ip.src -e ip.dst -e tcp.srcport -e tcp.dstport -e http.request.full_uri >
"$OUTPUT_DIR/artifacts/http_connect_tunnels.txt"



# ICMP Tunneling

log "[+] Checking for ICMP tunneling..."

tshark -r "$PCAP_FILE" -Y "icmp.type == 8 and data.len > 56" -T fields -e ip.src
-e ip.dst -e data.len | sort | uniq -c >
"$OUTPUT_DIR/artifacts/icmp_tunneling.txt"



# DNS Tunneling

log "[+] Checking for DNS tunneling..."

# Extract all DNS query names and analyze for entropy

tshark -r "$PCAP_FILE" -Y "dns.qry.name" -T fields -e ip.src -e dns.qry.name |
python3 -c '

import sys

import math

import collections

def entropy(data):

if not data:

return 0

entropy = 0

for x in range(256):

p_x = float(data.count(chr(x)))/len(data)

if p_x > 0:

entropy += - p_x * math.log2(p_x)

return entropy

# Count domains per source IP

ip_domains = collections.defaultdict(set)

ip_subdomains = collections.defaultdict(list)

all_queries = []

for line in sys.stdin:

parts = line.strip().split(None, 1)

if len(parts) == 2:

ip = parts[0]

domain = parts[1].lower()

all_queries.append((ip, domain))

ip_domains[ip].add(".".join(domain.split(".")[-2:])) # Track TLD+domain

subdomain = domain.split(".")[0]

if len(subdomain) > 10: # Only consider long subdomains

ip_subdomains[ip].append((domain, entropy(subdomain), len(subdomain)))

# Find IPs with many unique domains or high entropy subdomains

print("IP,Unique_Domains,Queries_with_High_Entropy,Avg_Entropy,Avg_Length")

for ip, domains in ip_domains.items():

if len(domains) > 5: # IP has queried more than 5 unique domains

high_entropy_queries = [q for q in ip_subdomains[ip] if q[1] > 4.0]

if high_entropy_queries:

avg_entropy = sum(q[1] for q in high_entropy_queries) /
len(high_entropy_queries)

avg_length = sum(q[2] for q in high_entropy_queries) / len(high_entropy_queries)

print(f"{ip},{len(domains)},{len(high_entropy_queries)},{avg_entropy:.2f},{avg_length:.2f}")

# Output samples of high entropy queries for inspection

print("\n=== Sample High Entropy Queries ===")

for ip, subdomains in ip_subdomains.items():

for domain, ent, length in subdomains:

if ent > 4.5 and length > 20: # Very high entropy and long

print(f"{ip} - {domain} (entropy: {ent:.2f}, length: {length})")

' > "$OUTPUT_DIR/artifacts/dns_tunneling_analysis.txt"



# SSH Tunneling - checking for unusual SSH patterns

log "[+] Checking for SSH tunneling..."

tshark -r "$PCAP_FILE" -Y "ssh" -T fields -e ip.src -e ip.dst -e tcp.dstport |
sort | uniq -c > "$OUTPUT_DIR/artifacts/ssh_connections.txt"



# SSL/TLS on Non-Standard Ports

log "[+] Checking for SSL/TLS on non-standard ports..."

tshark -r "$PCAP_FILE" -Y "ssl and tcp.dstport != 443 and tcp.dstport != 8443"
-T fields -e ip.src -e ip.dst -e tcp.dstport | sort | uniq -c >
"$OUTPUT_DIR/artifacts/ssl_nonstandard_ports.txt"

# TCP timing-based covert channels - looking for patterns in TCP timestamps

log "[+] Checking for TCP timing-based covert channels..."

tshark -r "$PCAP_FILE" -Y "tcp.flags == 0x018" -T fields -e ip.src -e ip.dst -e
tcp.dstport -e tcp.time_delta -e tcp.stream | python3 -c '

import sys

import collections

import statistics

streams = collections.defaultdict(list)

for line in sys.stdin:

parts = line.strip().split()

if len(parts) >= 5:

try:

src = parts[0]

dst = parts[1]

port = parts[2]

delta = float(parts[3])

stream = parts[4]



# Only consider reasonable deltas

if 0.001 < delta < 2.0:

streams[(src, dst, port, stream)].append(delta)

except:

pass

# Analyze delta patterns in each stream

print("Source,Destination,Port,Stream,Packets,Pattern_Found,Description")

for (src, dst, port, stream), deltas in streams.items():

if len(deltas) >= 10: # Need enough packets to detect a pattern

# Look for binary patterns in timing

short_deltas = 0

long_deltas = 0



median = statistics.median(deltas)



# Classify deltas as short or long relative to median

binary_pattern = ""

for delta in deltas:

if delta < median * 0.8:

binary_pattern += "0"

short_deltas += 1

elif delta > median * 1.2:

binary_pattern += "1"

long_deltas += 1

else:

binary_pattern += "X" # Middle range



# Check if we have a reasonable binary distribution

if short_deltas >= 3 and long_deltas >= 3 and (short_deltas + long_deltas) /
len(deltas) > 0.7:

print(f"{src},{dst},{port},{stream},{len(deltas)},YES,Potential timing channel:
distinct timing pattern detected")

else:

print(f"{src},{dst},{port},{stream},{len(deltas)},NO,Normal timing
distribution")

' > "$OUTPUT_DIR/artifacts/tcp_timing_channels.txt"



# Create summary of covert channel findings

{

echo "=== Covert Channel and Protocol Tunneling Summary ==="

echo ""



echo "HTTP CONNECT Tunnels:"

if [ -s "$OUTPUT_DIR/artifacts/http_connect_tunnels.txt" ]; then

cat "$OUTPUT_DIR/artifacts/http_connect_tunnels.txt"

else

echo "None detected"

fi

echo ""



echo "ICMP Tunneling:"

if [ -s "$OUTPUT_DIR/artifacts/icmp_tunneling.txt" ]; then

cat "$OUTPUT_DIR/artifacts/icmp_tunneling.txt"

else

echo "None detected"

fi

echo ""



echo "DNS Tunneling Analysis:"

if [ -s "$OUTPUT_DIR/artifacts/dns_tunneling_analysis.txt" ]; then

cat "$OUTPUT_DIR/artifacts/dns_tunneling_analysis.txt"

else

echo "None detected"

fi

echo ""



echo "SSL/TLS on Non-Standard Ports:"

if [ -s "$OUTPUT_DIR/artifacts/ssl_nonstandard_ports.txt" ]; then

cat "$OUTPUT_DIR/artifacts/ssl_nonstandard_ports.txt"

else

echo "None detected"

fi

echo ""



echo "TCP Timing-Based Covert Channels:"

if [ -s "$OUTPUT_DIR/artifacts/tcp_timing_channels.txt" ]; then

grep "YES" "$OUTPUT_DIR/artifacts/tcp_timing_channels.txt"

echo "Total TCP streams analyzed: $(wc -l <
"$OUTPUT_DIR/artifacts/tcp_timing_channels.txt")"

else

echo "None detected"

fi



} > "$OUTPUT_DIR/reports/covert_channels_summary.txt"



log "[+] Tunneled protocol detection complete"

}

# Function to analyze encrypted traffic patterns

analyze_encrypted_traffic() {

log "[+] Analyzing encrypted traffic patterns..."



# Extract all SSL/TLS sessions

mkdir -p "$OUTPUT_DIR/artifacts/tls_analysis"

tshark -r "$PCAP_FILE" -Y "ssl" -T fields -e tcp.stream | sort | uniq >
"$OUTPUT_DIR/artifacts/tls_analysis/tls_streams.txt"



# JA3 fingerprinting for client identification

tshark -r "$PCAP_FILE" -Y "ssl.handshake.type == 1" -T fields -e ip.src -e
tcp.srcport -e ip.dst -e tcp.dstport -e ssl.handshake.ja3 -e
ssl.handshake.ja3_full >
"$OUTPUT_DIR/artifacts/tls_analysis/ja3_fingerprints.txt"



# JA3S fingerprinting for server identification

tshark -r "$PCAP_FILE" -Y "ssl.handshake.type == 2" -T fields -e ip.src -e
tcp.srcport -e ip.dst -e tcp.dstport -e ssl.handshake.ja3s -e
ssl.handshake.ja3s_full >
"$OUTPUT_DIR/artifacts/tls_analysis/ja3s_fingerprints.txt"



# Extract TLS SNI (Server Name Indication) values

tshark -r "$PCAP_FILE" -Y "ssl.handshake.extensions_server_name" -T fields -e
ip.src -e tcp.srcport -e ip.dst -e tcp.dstport -e
ssl.handshake.extensions_server_name >
"$OUTPUT_DIR/artifacts/tls_analysis/tls_sni.txt"



# Extract certificate details

tshark -r "$PCAP_FILE" -Y "ssl.handshake.certificate" -T fields -e ip.src -e
tcp.srcport -e ip.dst -e tcp.dstport -e x509sat.uTF8String -e
x509sat.printableString > "$OUTPUT_DIR/artifacts/tls_analysis/certificates.txt"



# Look for mismatches between SNI and certificate CN

python3 -c '

import sys

import os

def read_file_to_dict(filename, key_cols, val_cols):

result = {}

if not os.path.exists(filename):

return result



with open(filename, "r") as f:

for line in f:

parts = line.strip().split("\t")

if len(parts) >= key_cols + val_cols:

key = tuple(parts[:key_cols])

val = tuple(parts[key_cols:key_cols+val_cols])

result[key] = val

return result

# Get SNI values

sni_file = sys.argv[1]

sni_data = read_file_to_dict(sni_file, 4, 1)

# Get certificate CN values

cert_file = sys.argv[2]

cert_data = read_file_to_dict(cert_file, 4, 2)

# Compare SNI with certificate CN

print("Client,Client_Port,Server,Server_Port,SNI,Certificate_CN,Mismatch")

for key, sni in sni_data.items():

if key in cert_data:

src, src_port, dst, dst_port = key

cert_cn = cert_data[key][0]



# Basic check for SNI vs CN mismatch - could be more sophisticated

if sni[0] and cert_cn and sni[0] not in cert_cn and not
cert_cn.endswith(sni[0]):

print(f"{src},{src_port},{dst},{dst_port},{sni[0]},{cert_cn},YES")

else:

print(f"{src},{src_port},{dst},{dst_port},{sni[0]},{cert_cn},NO")

' "$OUTPUT_DIR/artifacts/tls_analysis/tls_sni.txt"
"$OUTPUT_DIR/artifacts/tls_analysis/certificates.txt" >
"$OUTPUT_DIR/artifacts/tls_analysis/sni_cert_comparison.txt"



# Look for unusual JA3 fingerprints

log "[+] Analyzing client TLS fingerprints..."

{

echo "JA3 Fingerprint,Count,Source IPs,Destination IPs,Destination Ports"

awk -F '\t' '{print $5}'
"$OUTPUT_DIR/artifacts/tls_analysis/ja3_fingerprints.txt" | sort | uniq -c |
sort -nr | while read count ja3; do

if [ -n "$ja3" ]; then

# For each JA3, find the unique src IPs, dst IPs, and dst ports

src_ips=$(grep "$ja3" "$OUTPUT_DIR/artifacts/tls_analysis/ja3_fingerprints.txt"
| cut -f 1 | sort | uniq | wc -l)

dst_ips=$(grep "$ja3" "$OUTPUT_DIR/artifacts/tls_analysis/ja3_fingerprints.txt"
| cut -f 3 | sort | uniq | wc -l)

dst_ports=$(grep "$ja3"
"$OUTPUT_DIR/artifacts/tls_analysis/ja3_fingerprints.txt" | cut -f 4 | sort |
uniq | wc -l)

echo "$ja3,$count,$src_ips,$dst_ips,$dst_ports"

fi

done

} > "$OUTPUT_DIR/artifacts/tls_analysis/ja3_statistics.csv"



# Traffic size and timing analysis for encrypted sessions

log "[+] Analyzing encrypted traffic patterns..."

for stream in $(cat "$OUTPUT_DIR/artifacts/tls_analysis/tls_streams.txt"); do

tshark -r "$PCAP_FILE" -Y "tcp.stream == $stream" -T fields -e frame.time_epoch
-e ip.src -e ip.dst -e tcp.len -e tcp.srcport -e tcp.dstport >
"$OUTPUT_DIR/artifacts/tls_analysis/stream_${stream}_details.txt"

done



# Summarize encrypted traffic analysis

{

echo "=== Encrypted Traffic Analysis Summary ==="

echo ""



echo "TLS Sessions: $(wc -l <
"$OUTPUT_DIR/artifacts/tls_analysis/tls_streams.txt")"

echo ""



echo "Top 10 JA3 Client Fingerprints:"

head -10 "$OUTPUT_DIR/artifacts/tls_analysis/ja3_statistics.csv"

echo ""



echo "SNI/Certificate Mismatches:"

grep "YES" "$OUTPUT_DIR/artifacts/tls_analysis/sni_cert_comparison.txt"
2>/dev/null || echo "None detected"

echo ""



echo "Self-Signed Certificates:"

if [ -s "$OUTPUT_DIR/artifacts/self_signed_certs.txt" ]; then

cat "$OUTPUT_DIR/artifacts/self_signed_certs.txt"

else

echo "None detected"

fi

echo ""



echo "Unusual SSL/TLS Ports:"

if [ -s "$OUTPUT_DIR/artifacts/ssl_nonstandard_ports.txt" ]; then

cat "$OUTPUT_DIR/artifacts/ssl_nonstandard_ports.txt"

else

echo "None detected"

fi

} > "$OUTPUT_DIR/reports/encrypted_traffic_summary.txt"



log "[+] Encrypted traffic analysis complete"

}

# Function to generate a final report

generate_final_report() {

log "[+] Generating final report..."



# Create an executive summary

REPORT_FILE="$OUTPUT_DIR/Network_Forensics_Report_${DATE_TAG}.md"



cat > "$REPORT_FILE" << EOF

# Network Forensics Analysis Report

## Executive Summary

**PCAP File:** $(basename "$PCAP_FILE")

**Analysis Date:** $(date)

**Analysis Duration:** $(cat "$OUTPUT_DIR/reports/pcap_info.txt" | grep "Capture
duration:" | cut -d: -f2- | xargs || echo "Unknown")

### Overview

This report presents the findings of a network forensics analysis conducted on
the provided PCAP file. The analysis focused on identifying malicious or
suspicious network activities, including potential lateral movement, data
exfiltration, command and control communications, and protocol anomalies.

### Key Findings

#### Traffic Statistics

- Total Packets: $(cat "$OUTPUT_DIR/reports/pcap_info.txt" | grep "Number of
packets:" | cut -d: -f2 | xargs || echo "Unknown")

- Capture Size: $(cat "$OUTPUT_DIR/reports/pcap_info.txt" | grep "File size:" |
cut -d: -f2 | xargs || echo "Unknown")

- Unique IP Addresses: $(cat "$OUTPUT_DIR/artifacts/src_ips.txt"
"$OUTPUT_DIR/artifacts/dst_ips.txt" | sort | uniq | wc -l)

- Unique TCP Ports: $(wc -l < "$OUTPUT_DIR/artifacts/tcp_ports.txt" 2>/dev/null
|| echo "0")

- Unique UDP Ports: $(wc -l < "$OUTPUT_DIR/artifacts/udp_ports.txt" 2>/dev/null
|| echo "0")

$(if [ -s "$OUTPUT_DIR/artifacts/threat_matches" ]; then

echo "#### Threat Intelligence Matches"

echo "- **WARNING:** Traffic matching known threat indicators was detected"

echo "- See the Threat Intel section for details"

echo ""

fi)

#### Protocol Anomalies

$(if [ -s "$OUTPUT_DIR/artifacts/http_nonstandard_ports.txt" ]; then

echo "- HTTP traffic on non-standard ports detected"

fi)

$(if [ -s "$OUTPUT_DIR/artifacts/dns_nonstandard_ports.txt" ]; then

echo "- DNS traffic on non-standard ports detected"

fi)

$(if [ -s "$OUTPUT_DIR/artifacts/self_signed_certs.txt" ]; then

echo "- Self-signed SSL certificates detected"

fi)

$(if [ -s "$OUTPUT_DIR/artifacts/external_smb.txt" ]; then

echo "- SMB traffic outside local network detected"

fi)

$(if [ -s "$OUTPUT_DIR/artifacts/ssh_nonstandard_ports.txt" ]; then

echo "- SSH traffic on non-standard ports detected"

fi)

#### Data Exfiltration Indicators

$(if [ -s "$OUTPUT_DIR/artifacts/dns_tunneling_analysis.txt" ]; then

echo "- Potential DNS tunneling activity detected"

fi)

$(if [ -s "$OUTPUT_DIR/artifacts/high_entropy_dns.txt" ]; then

echo "- High entropy DNS queries detected (possible encoded data)"

fi)

$(if [ -s "$OUTPUT_DIR/artifacts/beaconing_patterns.csv" ] && [ $(grep -c "YES"
"$OUTPUT_DIR/artifacts/tcp_timing_channels.txt" 2>/dev/null) -gt 0 ]; then

echo "- Command and control beaconing patterns detected"

fi)

$(if [ -s "$OUTPUT_DIR/artifacts/icmp_tunneling.txt" ]; then

echo "- ICMP tunneling indicators detected"

fi)

#### Extracted Artifacts

- Network communications preserved for investigation

- $(find "$OUTPUT_DIR/extracted_files" -type f | wc -l) files extracted from
network streams

- $(wc -l < "$OUTPUT_DIR/artifacts/http_urls.txt" 2>/dev/null || echo "0")
unique URLs captured

- $(wc -l < "$OUTPUT_DIR/artifacts/dns_queries.txt" 2>/dev/null || echo "0")
unique DNS queries

### Recommendations

Based on the analysis findings, the following actions are recommended:

1. Investigate hosts with suspicious communication patterns

2. Analyze extracted files for malicious content

3. Block communication with identified malicious domains/IPs

4. Review network security controls and monitoring capabilities

5. Implement detection rules based on identified TTPs

## Detailed Analysis Results

### Protocol Distribution

\`\`\`

$(head -20 "$OUTPUT_DIR/reports/protocol_hierarchy.txt" 2>/dev/null || echo
"Protocol hierarchy not available")

\`\`\`

### Top Talkers

\`\`\`

$(head -10 "$OUTPUT_DIR/reports/ip_conversations.txt" 2>/dev/null || echo "IP
conversation data not available")

\`\`\`

EOF

# Add protocol anomaly section

cat >> "$REPORT_FILE" << EOF

### Protocol Anomalies

#### HTTP on Non-Standard Ports

$(if [ -s "$OUTPUT_DIR/artifacts/http_nonstandard_ports.txt" ]; then

echo "\`\`\`"

echo "Source IP,Destination IP,Destination Port,URI"

cat "$OUTPUT_DIR/artifacts/http_nonstandard_ports.txt" | tr '\t' ','

echo "\`\`\`"

else

echo "No HTTP traffic on non-standard ports detected."

fi)

#### Self-Signed Certificates

$(if [ -s "$OUTPUT_DIR/artifacts/self_signed_certs.txt" ]; then

echo "\`\`\`"

cat "$OUTPUT_DIR/artifacts/self_signed_certs.txt" | tr '\t' ','

echo "\`\`\`"

else

echo "No self-signed certificates detected."

fi)

#### Cleartext Authentication

$(if [ -s "$OUTPUT_DIR/artifacts/cleartext_auth_http.txt" ]; then

echo "\`\`\`"

echo "Source IP,Destination IP,Port,URI"

cat "$OUTPUT_DIR/artifacts/cleartext_auth_http.txt" | tr '\t' ','

echo "\`\`\`"

else

echo "No cleartext authentication detected."

fi)

EOF

# Add data exfiltration section

cat >> "$REPORT_FILE" << EOF

### Data Exfiltration Analysis

#### Large Data Transfers

\`\`\`

$(head -10 "$OUTPUT_DIR/artifacts/large_transfers.txt" 2>/dev/null || echo "No
large transfers detected")

\`\`\`

#### DNS Tunneling Indicators

$(if [ -s "$OUTPUT_DIR/artifacts/dns_tunneling_analysis.txt" ]; then

echo "\`\`\`"

head -20 "$OUTPUT_DIR/artifacts/dns_tunneling_analysis.txt"

echo "\`\`\`"

else

echo "No DNS tunneling indicators detected."

fi)

#### Beaconing Pattern Detection

$(if [ -s "$OUTPUT_DIR/artifacts/beaconing_patterns.csv" ]; then

echo "\`\`\`"

cat "$OUTPUT_DIR/artifacts/beaconing_patterns.csv"

echo "\`\`\`"

else

echo "No regular beaconing patterns detected."

fi)

EOF

# Add covert channel section

cat >> "$REPORT_FILE" << EOF

### Covert Channels and Tunneled Protocols

#### ICMP Tunneling

$(if [ -s "$OUTPUT_DIR/artifacts/icmp_tunneling.txt" ]; then

echo "\`\`\`"

cat "$OUTPUT_DIR/artifacts/icmp_tunneling.txt"

echo "\`\`\`"

else

echo "No ICMP tunneling detected."

fi)

#### TCP Timing Channels

$(if [ -s "$OUTPUT_DIR/artifacts/tcp_timing_channels.txt" ] && [ $(grep -c "YES"
"$OUTPUT_DIR/artifacts/tcp_timing_channels.txt") -gt 0 ]; then

echo "\`\`\`"

grep "YES" "$OUTPUT_DIR/artifacts/tcp_timing_channels.txt"

echo "\`\`\`"

else

echo "No TCP timing channels detected."

fi)

#### HTTP CONNECT Tunnels

$(if [ -s "$OUTPUT_DIR/artifacts/http_connect_tunnels.txt" ]; then

echo "\`\`\`"

cat "$OUTPUT_DIR/artifacts/http_connect_tunnels.txt" | tr '\t' ','

echo "\`\`\`"

else

echo "No HTTP CONNECT tunnels detected."

fi)

EOF

# Add encrypted traffic section

cat >> "$REPORT_FILE" << EOF

### Encrypted Traffic Analysis

#### TLS Fingerprinting (JA3)

Top 10 client TLS fingerprints:

\`\`\`

$(head -10 "$OUTPUT_DIR/artifacts/tls_analysis/ja3_statistics.csv" 2>/dev/null
|| echo "No JA3 statistics available")

\`\`\`

#### Certificate/SNI Mismatches

$(if [ -s "$OUTPUT_DIR/artifacts/tls_analysis/sni_cert_comparison.txt" ] && grep
-q "YES" "$OUTPUT_DIR/artifacts/tls_analysis/sni_cert_comparison.txt"; then

echo "\`\`\`"

grep "YES" "$OUTPUT_DIR/artifacts/tls_analysis/sni_cert_comparison.txt" | tr ','
'\t'

echo "\`\`\`"

else

echo "No certificate/SNI mismatches detected."

fi)

EOF

# Add threat intelligence section if available

if [ -n "$THREAT_INTEL_DB" ] && [ -s "$OUTPUT_DIR/artifacts/threat_matches" ];
then

cat >> "$REPORT_FILE" << EOF

### Threat Intelligence Matches

The following traffic matched known threat indicators:

$(find "$OUTPUT_DIR/artifacts/threat_matches" -type f -name "domain_*" | while
read file; do

domain=$(basename "$file" | cut -d_ -f2-)

echo "* Domain: $domain"

echo " * Traffic:"

cat "$file" | head -5 | tr '\t' ' ' | sed 's/^/ * /'

if [ $(wc -l < "$file") -gt 5 ]; then

echo " * ... ($(expr $(wc -l < "$file") - 5) more connections)"

fi

echo ""

done)

$(find "$OUTPUT_DIR/artifacts/threat_matches" -type f -name "ip_*" | while read
file; do

ip=$(basename "$file" | cut -d_ -f2-)

echo "* IP Address: $ip"

echo " * Traffic:"

cat "$file" | head -5 | tr '\t' ' ' | sed 's/^/ * /'

if [ $(wc -l < "$file") -gt 5 ]; then

echo " * ... ($(expr $(wc -l < "$file") - 5) more connections)"

fi

echo ""

done)

EOF

fi

# Add extracted artifacts section

cat >> "$REPORT_FILE" << EOF

### Extracted Artifacts

#### File Extraction Summary

- HTTP Objects: $(find "$OUTPUT_DIR/extracted_files/http" -type f | wc -l
2>/dev/null || echo "0") files

- SMB Objects: $(find "$OUTPUT_DIR/extracted_files/smb" -type f | wc -l
2>/dev/null || echo "0") files

- TFTP Objects: $(find "$OUTPUT_DIR/extracted_files/tftp" -type f | wc -l
2>/dev/null || echo "0") files

- Email Artifacts: $(find "$OUTPUT_DIR/extracted_files/email" -type f | wc -l
2>/dev/null || echo "0") files

#### Top Domains Contacted

\`\`\`

$(cat "$OUTPUT_DIR/artifacts/dns_queries.txt" 2>/dev/null | sort | uniq -c |
sort -nr | head -20)

\`\`\`

#### Top User-Agents

\`\`\`

$(head -10 "$OUTPUT_DIR/artifacts/http_user_agents.txt" 2>/dev/null || echo "No
user-agent data")

\`\`\`

## Conclusion

The network traffic analysis has identified $(if [ -s
"$OUTPUT_DIR/artifacts/threat_matches" ] || [ -s
"$OUTPUT_DIR/artifacts/beaconing_patterns.csv" ] || [ -s
"$OUTPUT_DIR/artifacts/high_entropy_dns.txt" ]; then echo "potentially
suspicious"; else echo "no obvious malicious"; fi) activity. $(if [ -s
"$OUTPUT_DIR/artifacts/threat_matches" ] || [ -s
"$OUTPUT_DIR/artifacts/beaconing_patterns.csv" ] || [ -s
"$OUTPUT_DIR/artifacts/high_entropy_dns.txt" ]; then echo "Further investigation
is recommended to determine the full scope and impact of the identified
threats."; else echo "Regular security monitoring should continue."; fi)

The most significant findings include:

$(if [ -s "$OUTPUT_DIR/artifacts/threat_matches" ]; then

echo "- Traffic to known malicious domains/IPs"

fi)

$(if [ -s "$OUTPUT_DIR/artifacts/beaconing_patterns.csv" ]; then

echo "- Potential command and control beaconing patterns"

fi)

$(if [ -s "$OUTPUT_DIR/artifacts/high_entropy_dns.txt" ]; then

echo "- Possible DNS data exfiltration"

fi)

$(if [ -s "$OUTPUT_DIR/artifacts/self_signed_certs.txt" ]; then

echo "- Use of self-signed certificates"

fi)

$(if [ -s "$OUTPUT_DIR/artifacts/http_nonstandard_ports.txt" ]; then

echo "- HTTP services on non-standard ports"

fi)

$(if [ -s "$OUTPUT_DIR/artifacts/icmp_tunneling.txt" ]; then

echo "- Possible ICMP tunneling"

fi)

$(if [ ! -s "$OUTPUT_DIR/artifacts/threat_matches" ] && [ ! -s
"$OUTPUT_DIR/artifacts/beaconing_patterns.csv" ] && [ ! -s
"$OUTPUT_DIR/artifacts/high_entropy_dns.txt" ] && [ ! -s
"$OUTPUT_DIR/artifacts/self_signed_certs.txt" ] && [ ! -s
"$OUTPUT_DIR/artifacts/http_nonstandard_ports.txt" ] && [ ! -s
"$OUTPUT_DIR/artifacts/icmp_tunneling.txt" ]; then

echo "- No significant suspicious network activity"

fi)

**Report generated by:** Advanced Network Forensics PCAP Analyzer

**Date:** $(date)

EOF



log "[+] Final report generated: $REPORT_FILE"

}

# Main execution flow

log "[+] Starting Network Forensics Analysis on: $PCAP_FILE"

# Execute analysis functions

analyze_pcap_metadata

detect_protocol_anomalies

extract_network_artifacts

detect_data_exfiltration

detect_tunneled_protocols

analyze_encrypted_traffic

generate_final_report

log "[+] Network Forensics Analysis complete! Report available at:
$OUTPUT_DIR/Network_Forensics_Report_${DATE_TAG}.md"

# Make output directory readable

chmod -R 755 "$OUTPUT_DIR"