Focal Point - Network Traffic Analysis
Focal Point - Network Traffic Analysis Course Details:
Focal Point - Network Traffic Analysis will teach you to differentiate between normal and abnormal network traffic, track the flow of packets through a network, and attribute conversations and actions taken over a network segment to specific hosts or users. This course focuses on research, filtering, and comparative analysis to identify and attribute the different types of activity on a network. You will learn how to follow conversations across a wide range of protocols and through redirection, as well as how to develop custom filters for non-dissected protocols. On Day 5 of the course, you will participate in a team-based capture-the-flag exercise to test your new skills.
Call (919) 283-1674 to get a class scheduled online or in your area!
*Please Note: Course Outline is subject to change without notice. Exact course outline will be provided at time of registration.
- Create a baseline of the protocols, hosts and interactions in a network environment
- Identify anomalous network traffic using a combination of in-depth packet analysis and high-level statistical analysis
- Reconstruct event timelines and accurately correlate, or distinguish between, event threads
- Identify and extract network artifacts for further forensic analysis
- Compare observed network traffic to expected topology
- Research and analyze unknown (non-dissected) protocols
- Track web activity at the user or session level via HTTP header analytics
Student Practical:
Using the tools, skills, and methodologies taught in Days 1 - 4, on day 5 of the course students will participate in a competitive capture-the-flag exercise that includes various categories, including a simulated SCADA attack scenario. Designed to challenge the participants, each correctly completed milestone will unlock a successively more difficult challenge.
Course Outline:
- Building Blocks
- OSI &TCP/IP Review
- Wireshark Tutorial
- Day in the Life (Common Protocols)
- Extracting Objects
- TCP - A Deeper Look
- Analytic Approach
- Internet Research
- Isolating Traffic
- Routing Principles
- Traceroute Analysis
- Standards and Protocol Analysis
- Start-to-Finish Protocol
- Analysis (Email Example)
- Analysis Beyond Wireshark
- Secure Protocols
- HTTP Header Analytics
- Big Capture
- More Tools and Tricks
Labs:
- Wireshark Filtering (Part 1, Part 2)
- A Day in the Life (Common Protocols)
- Exporting Objects
- TCP/IP Analysis
- Internet Research
- Isolate Event #1
- Isolate Event #2
- Isolate Event #3
- Isolate Event #4
- Isolate Event #5
- RFC Research
- Meta-data Analysis
- Non-Dissected Protocol Analysis
- Encrypted Traffic Analysis Referer
- User-Agents
- Web Request Tracking
- Large Capture Investigation
- A broad understanding of TCP/IP and associated protocols
- Knowledge of network hardware and segment types
- Previous exposure to Wireshark or other protocol analysis software is also recommended
- Network analysts seeking to develop security-related skills
- Incident responders needing to quickly address system security breaches
- Penetration testers looking to reduce their detectability
- Threat operations analysts seeking a better understanding of network intrusions
- All network administrators needing a better understanding of network security