Network Forensics

When performing network traffic analysis, one key element to identify is established connections and then verify whether the connections are valid (and safe) or not. what are the three network evidence sources that show established connections between devices and one method you can use to verify the validity (safety) of those connections?

I am trying to understand step by step the process

Thanks