13.6 Network Device & Service Log Forensics: Firewall, IDS, Honeypot, Router, DHCP, Switch, VPN, DNS & SSH

13.6 Network Device & Service Log Forensics: Firewall, IDS, Honeypot, Router, DHCP, Switch, VPN, DNS & SSH

Quick Answer: Blueprint Domain 5 requires analyzing firewall, IDS, honeypot, router, and DHCP logs, then Cisco switch, VPN, and DNS server logs, then investigating SSH logs, and analyzing SMTP and SNMP traffic. Each device answers a different investigative question. Firewall and IDS logs answer what was attempted. DHCP logs answer who owned an IP address at a point in time — the single most important attribution step in any network case. Router and switch logs answer how traffic moved. VPN logs answer who was remote. DNS logs answer what the host tried to reach. SSH logs answer which credential or key authenticated.

---

Syslog: The Common Container

Almost every network device exports through syslog, so the format is worth memorizing.

PRI = Facility × 8 + Severity. Severity runs 0 Emergency, 1 Alert, 2 Critical, 3 Error, 4 Warning, 5 Notice, 6 Informational, 7 Debug.

[!IMPORTANT] RFC 3164's missing year and time zone is a recurring forensic trap. A legacy syslog line reads Sep 14 03:21:44 with no year and no offset. Correlating it against a UTC-stamped web log requires knowing the device's configured time zone and the year, both of which must be documented from the device configuration — not assumed.

---

Firewall and IDS/IPS Logs

Firewall logs record the connection decision: 5-tuple, action (permit/deny/drop), interface, rule or ACL identifier, and byte/packet counts on session teardown.

The forensically decisive field is usually bytes. A teardown record showing 4 GB sent outbound to an unfamiliar destination on port 443 is exfiltration evidence even when payload was never captured.

IDS/IPS logs record signature matches. Snort and Suricata write alert entries carrying the SID (signature ID), GID, revision, classification, priority, and the triggering 5-tuple; Suricata's eve.json additionally emits protocol, TLS/JA3, HTTP, DNS, and file-extraction records that make it a partial substitute for full packet capture.

• An IDS alert is a signature match, not proof of compromise. Validate it against the packet capture or the destination host's own logs.
• Tuned-out or disabled signatures explain silence. Always retrieve the ruleset state at the time of the incident, not the current one.

Honeypot Logs

A honeypot has no production purpose, so every interaction is unauthorized by construction — the false-positive rate is effectively zero, which is why honeypot evidence carries disproportionate weight.

Cowrie's TTY replay files reconstruct the attacker's session keystroke-by-keystroke, including typing errors and pauses — evidence of live human interaction rather than automation, which matters for both attribution and sentencing.

---

DHCP Logs: The Attribution Keystone

An IP address in a web log is meaningless on a dynamic internal network without the lease record that bound it to a host.

Windows DHCP event IDs to know: 10 new lease assigned, 11 lease renewed, 12 lease released, 13 IP found in use on network, 14 lease request could not be satisfied, 15 lease denied (NACK), 24 database cleanup.

[!WARNING] Windows DHCP logs rotate weekly by file name (DhcpSrvLog-Mon.log … DhcpSrvLog-Sun.log), overwriting the same weekday file each week. An incident discovered eight days late may have already lost its lease record. Preserve DHCP logs in the first hour of any network investigation.

The correlation chain is: web/proxy log (IP + timestamp) → DHCP lease (IP + MAC + hostname at that timestamp) → switch CAM/MAC address table or 802.1X authentication (MAC + physical port) → asset inventory (host + assigned user).

---

Router and Switch Logs

Cisco IOS syslog format: %FACILITY-SEVERITY-MNEMONIC: message-text, for example %SEC-6-IPACCESSLOGP: list 101 denied tcp 203.0.113.44(4221) -> 10.0.2.15(3389), 1 packet.

Forensically valuable IOS messages:

Switch-specific evidence: the CAM/MAC address table (show mac address-table) maps MAC to physical port — but it is volatile, aging out in about 5 minutes by default. Capturing it requires live collection during the incident. The ARP cache (show ip arp) maps IP to MAC with a default 4-hour timeout.

[!IMPORTANT] The running configuration exists only in RAM. show running-config reflects live state; show startup-config reflects NVRAM. An attacker who modifies the running config without writing it leaves evidence that a reboot silently erases. Live capture of show running-config, show mac address-table, show ip arp, show users, and show logging is the network equivalent of a RAM dump, and it must precede any remediation reboot.

---

VPN Logs

VPN concentrators answer who was remote, from where, for how long, and with what internal address.

Essential fields: username, authentication result and method (password, certificate, MFA token), public source IP with geolocation, assigned internal tunnel IP, session start and end, bytes transferred, and client posture.

The pivot that matters: the assigned tunnel IP is what appears in every internal log. Attribution requires joining the internal activity to the VPN session that held that tunnel IP at that moment. Because tunnel addresses are recycled from a pool, the timestamp is as essential as the address.

Characteristic findings: impossible travel (two authentications from distant countries minutes apart), a single account with concurrent sessions from different sources, and authentication success from a source that never appears in the account's history.

---

DNS Server Logs

DNS is the highest-yield low-volume telemetry in an investigation because nearly every attacker action begins with a name resolution.

Detection patterns:

• DNS tunneling — abnormally long labels, high-entropy subdomains, heavy TXT/NULL query volume, and sustained query rate to a single second-level domain. Exfiltration over DNS is encoded in the query name, so query length distribution is the tell.
• DGA (domain generation algorithm) — bursts of NXDOMAIN responses for high-entropy names as malware cycles candidate domains before finding the live one. The domain that finally resolves is the C2.
• DNS hijacking/spoofing — responses for a known domain returning an unexpected address, or an endpoint querying a resolver that is not the sanctioned one (a rogue resolver configured by malware).
• Fast flux — very low TTLs with a rapidly rotating address set for one name.

---

SSH Logs

Record types to parse:

Accepted password for jsmith from 203.0.113.44 port 51422 ssh2
Accepted publickey for root from 198.51.100.7 port 40112 ssh2: RSA SHA256:8Lc9k...
Failed password for invalid user admin from 203.0.113.44 port 51388 ssh2
Disconnected from authenticating user root 203.0.113.44 port 51390 [preauth]

• Accepted publickey ... SHA256:<fingerprint> is the highest-value line in the file: the fingerprint identifies which key authenticated, which can be matched against ~/.ssh/authorized_keys entries across the estate to trace attacker key implantation.
• Failed password for invalid user X means the account does not exist — automated scanning. Failed password for X on a real account is targeted.
• Correlate with wtmp/btmp/lastlog (parsed via last, lastb), shell history files, and ~/.ssh/authorized_keys modification times.

SMTP and SNMP Traffic

SMTP traffic analysis reveals mass outbound mail from a non-mail host (compromised spam relay), MAIL FROM values inconsistent with the organization's domains, and large attachments leaving on port 25/587 as an exfiltration channel. Capture of the DATA phase yields full message content including headers and attachments.

SNMP is frequently overlooked. Community strings in SNMPv1/v2c travel in cleartext, so a capture containing public or private exposes device enumeration and potential configuration write access. A host performing SNMP GETBULK walks across the address space is conducting network reconnaissance; SNMPv3 with authPriv is the remediation, and its absence is itself a finding.