Development of an Automated Network Forensics Analysis Tool Using PCAP Data

Network forensic investigation often requires analysts to inspect packet captures manually, construct protocol filters, correlate traffic events, and prepare evidence summaries. That workflow is powerful for expert investigators but difficult for novice analysts and users with limited forensic experience. Net-Forensics was designed to simplify the forensic workflow for such users, however, no formal usability study has yet been conducted. NetForensics is a web-based PCAP/PCAPNG network forensic tool that converts packet-capture evidence into an explainable dashboard and downloadable reports. The system implements a six-phase workflow: packet parsing, feature extraction, rule-based detection, correlation, dashboard visualization, and report generation. The implementation uses Python, Flask, Scapy, Chart.js, and modular detection components for DDoS-like fan-in traffic, port scanning, traffic spikes, protocol dominance, and unusual destination ports. The dashboard presents packet counts, flow counts, unique sources, severity, confidence, packet-rate timelines, protocol distribution, destination-port usage, top sources, and alert evidence. The system exports JSON, CSV, and PDF reports so that the same investigation can be reviewed in machine-readable, tabular, and human-readable formats. Experimental evaluation on six synthetic PCAP scenarios containing 124,561 packets demonstrated that NetForensics successfully parsed all captures and correctly triggered the DDoS, port-scan, traffic-spike, and unusual-port detectors in every intended scenario while generating consistent dashboard metrics and JSON, CSV, and PDF reports. The contribution is a complete PCAP-to-report forensic workflow designed for academic laboratories and first-stage incident triage, with emphasis on transparency, usability, explainability, and reproducible source code rather than unsupported benchmark claims.

@article{Alotaibi2026,
  title     = {Development of an Automated Network Forensics Analysis Tool Using PCAP Data},
  journal   = {International Journal of Advanced Computer Science and Applications},
  volume    = {17},
  number    = {7},
  year      = {2026},
  publisher = {The Science and Information Organization},
  author    = {Ashwag Alotaibi and Huda Aldawghan and Abdullah Albuali},
  doi       = {10.14569/IJACSA.2026.0170780},
  url       = {https://doi.org/10.14569/IJACSA.2026.0170780}
}