Packets don’t lie — a network forensics guide with tcpdump, Wireshark, and Zeek

Attackers can wipe logs, tamper with timestamps, and kill your EDR. They can’t make the packets that crossed your network disappear. Here’s how to capture them, dissect them, and turn them into unassailable evidence using three essential tools.