Network Forensics

Retrieve information about the geolocation of an IP address

curl ipinfo.io/IP

Banner Grabbing

• Many network services announce their presence with a banner containing version information during initial connection

• This information is visible in the first few packets of a connection

• In Wireshark look in Packet Details and Packet Bytes panes