“Active Traffic Capture for Network Forensics”

Slaviero, Granova, and Olivier


Citation information

M. L. Slaviero, A. Granova, and M. S. Olivier. “Active Traffic Capture for Network Forensics”. In: Advances in Digital Forensics II. Ed. by M. S. Olivier and S. Shenoi. Springer, 2006, pp. 215–228


Network traffic capture is an integral part of network forensics, but current traffic capture techniques are typically passive in nature. Under heavy loads, it is possible for a sniffer to miss packets, which affects the quality of forensic evidence.

This paper explores means for active capture of network traffic. In particular, it examines how traffic capture can influence the stream under surveillance so that no data is lost. A tool that forces TCP retransmissions is presented. The paper also provides a legal analysis—based on United States and South African laws—which shows that few legal obstacles are faced by traffic capture techniques that force attackers to retransmit data.

Definitive version

The definitive version of the paper is available from the publisher.
DOI: 10.1007/0-387-36891-4_17

BibTeX reference

AUTHOR={Marco L Slaviero and Anna Granova and Martin S Olivier},
TITLE={Active Traffic Capture for Network Forensics},
BOOKTITLE={Advances in Digital Forensics {II}},
EDITOR={Martin S Olivier and Sujeet Shenoi},
PAGES={215--228} )

[Publications] [Home]
Page maintained by Martin Olivier
Database updated: November 8, 2015

Beta version of new bibliography database; please report errors (or copyright violations) that may have slipped in.