Network Forensics and Investigation I

The preponderance of network traffic, particularly web traffic, was an expected outcome of the pivotal role that the Internet has come to play in our daily lives. The sheer volume of traffic and complexity of protocols creates a very diverse and everchanging landscape within which the network analyst must navigate. Network Forensics and Investigation teaches attendees to differentiate between normal and abnormal network traffic, track the flow of packets through a network, and attribute conversations and actions taken over a network segment to specific hosts or users. This course focuses on research, filtering, and comparative analysis to identify and attribute the different types of activity on a network. Students will learn how to follow conversations across a wide range of protocols and through redirection and how to develop custom filters for non-dissected protocols. On Day 5 of the course, you will participate in a team-based capture-the-flag exercise to test your new skills.
Before taking this course, students should have a broad understanding of TCP/IP and associated protocols. knowledge of network hardware and segment types, and previous exposure to Wireshark or other protocol analysis software is also recommended.
5 Days/Lecture & Lab
  • Network analysts seeking to develop security-related skills
  • Incident responders needing to quickly address system security breaches
  • Penetration testers looking to reduce their detectability
  • Threat operations analysts seeking a better understanding of network intrusions
  • All network administrators needing a better understanding of network security
  • Building Blocks
  • OSI &TCP/IP Review
  • Wireshark Primer
  • Day in the Life (Common Protocols)
  • Extracting Objects
  • TCP - A Deeper Look
  • Analytic Approach
  • Open-Source Research
  • Isolating Traffic
  • Routing Principles
  • Traceroute Analysis
  • Standards and Protocol Analysis
  • HTTP Analytics
  • Encoding and Encryption
  • Encrypted Traffic Analysis
  • Big Capture
  • More Tools and Tricks

Related Scheduled Courses