Passive Methods for Network Forensics and Deep Packet Inspection (Dpi) in Local Area Networks

Network forensics is a critical element of the modern cybersecurity incident investigation process. Unlike active scanning methods, passive analysis enables the extraction of evidentiary material without modifying network traffic and without the risk of exposing the analysis station. This report examines the application of passive Deep Packet Inspection (DPI) methods within Local Area Network (LAN) environments. The focus is placed on the technological framework for Full Packet Capture (FPC), the chronological reassembly of TCP/IP sessions, and the decoding of transport and application-layer protocol structures. By utilizing open-source software tools (tcpdump, Wireshark, TShark), the full cycle of forensic analysis is demonstrated – ranging from the generation of raw .pcap datasets to the extraction of Indicators of Compromise (IoCs) and the reconstruction of transferred files. The report outlines key methodological recommendations for preserving the integrity of digital evidence and analyzes the challenges arising from the widespread adoption of encrypted protocols (TLS/HTTPS).