In the 21st century, the increased use of the Internet also leads to the increase in various types of attacks where criminals try to commit fraud, theft, and other malicious activities in various ways. Network forensics, as a response to cybercrime, is a branch of digital forensics that investigates suspicious activities and events closely related to digital networks. The OSCAR methodology is the most appropriate method that includes the steps of gathering information, developing a strategy, collecting evidence, conducting analysis, and creating a report which is used by the investigators to conduct investigations thoroughly. Among many sources of network evidence, the ones that should be mentioned are the evidence on switches, routers, firewalls, and those on the “wire”. The collection of evidence can be carried out by physically intercepting the data in the wire, by using a software for capturing the network traffic and by active collection. During the analysis of network traffic itself, the investigators are faced with numerous active and passive network attacks. There are many systems for monitoring the network traffic, and one of them is SolarWinds Security Event Manager which makes it easier for the investigators to conduct the analysis and link the evidence when they arrive at the crime scene.