What should I consider with a network appliance?¶

A network appliance may control traffic, security, connectivity or access for many other systems.

Evidential caution: that a router, firewall or switch is only supporting equipment. It may hold volatile logs, active connection data, security alerts, configuration records and evidence of current network activity.

What this means¶

Avoid logging into the management interface simply to look around. Authentication, navigation and configuration access may create logs or change the state.

Where immediate isolation is required to stop serious harm, record the original state and use the narrowest effective action available.

Document every cable change, restart, login and configuration action.

What to check or do next¶

• Record the appliance as found. Photograph displays, status lights, labels, ports, cables, serial numbers and connected devices.
• Note whether it appears powered on, whether alarms or warnings are visible and whether any management console is already open.
• Do not restart or reset the appliance. Restarting may clear logs, connection tables, temporary configuration and active session information.
• Do not disconnect network cables without understanding what services or systems they support. One cable may affect an entire site, security system or evidential network.
• Identify the device role where possible: router, firewall, switch, wireless controller, proxy, load balancer, gateway or security appliance.
• If the appliance is involved in an active incident, live data may be highly volatile. Network, incident-response or forensic specialists should be engaged quickly.
• Preserve any visible clock, uptime, interface names and connection counts, because they may help specialists interpret later records.