Editing Man-in-the-middle attack (section)

=== Forensic analysis ===
[[Packet capture|Captured network traffic]] from what is suspected to be an attack can be analyzed in order to determine whether there was an attack and, if so, determine the source of the attack. Important evidence to analyze when performing [[network forensics]] on a suspected attack includes:<ref>{{cite web |url=http://www.netresec.com/?page=Blog&month=2011-03&post=Network-Forensic-Analysis-of-SSL-MITM-Attacks |title=Network Forensic Analysis of SSL MITM Attacks |work=NETRESEC Network Security Blog |date=2011-03-27|access-date=2011-03-27}}</ref>
* IP address of the server
* DNS name of the server
* [[X.509]] certificate of the server
** Whether the certificate has been self signed
** Whether the  certificate has been signed by a trusted [[certificate authority]]
** Whether the certificate has been [[certificate revocation|revoked]]
** Whether the certificate has been changed recently
** Whether other clients, elsewhere on the Internet, received the same certificate