What is a network log?¶

A network log records activity observed by equipment or software involved in moving, controlling or monitoring communications between systems.

It may come from a router, switch, firewall, wireless controller, intrusion-detection system, load balancer or network-monitoring platform.

Avoid this assumption: That a network log shows exactly what a person did online and identifies the device or user responsible. Usually, it shows a narrower technical observation.

A network record may include source and destination IP addresses, ports, protocol, connection direction, action, volume of data, interface and timestamp. It can help establish that one system attempted or made a connection to another, that traffic was allowed or blocked, or that a device appeared on a particular network.

But the observing system may see only part of the communication. Encryption may hide the content. Network address translation may replace an internal address with a shared public address. Proxies, VPNs and cloud services may alter the apparent route. One IP address may represent many users or devices.

Even where a device is identified, the log does not automatically show who controlled it or why the traffic occurred. Background services, updates, synchronisation, advertising, malware and automated applications can all generate network activity.

Investigators should establish where in the network the log was created and what that point could see. Ask whether addresses are internal or public, whether NAT was used, what time zone applied and whether packet content, flow data or only connection metadata was retained.

Preserve surrounding records and relevant configuration. Correlate network entries with DHCP, VPN, authentication, endpoint, application and provider records. Avoid treating a connection attempt as proof that data was exchanged or an offence completed.

Operational takeaway¶

A network log records traffic as seen from one observation point, but routing, shared infrastructure, automation and limited visibility constrain attribution and meaning.