  Network forensics deals with the capture, recording and analysis of network
events in order to discover evidential information about the source of security
attacks in a court of law. This paper discusses the different tools and
techniques available to conduct network forensics. Some of the tools discussed
include: eMailTrackerPro to identify the physical location of an email sender;
Web Historian to find the duration of each visit and the files uploaded and
downloaded from the visited website; packet sniffers like Etherea to capture
and analyze the data exchanged among the different computers in the network.
The second half of the paper presents a survey of different IP traceback
techniques like packet marking that help a forensic investigator to identify
the true sources of the attacking IP packets. We also discuss the use of
Honeypots and Honeynets that gather intelligence about the enemy and the tools
and tactics of network intruders.
