Duration: 21 Hours (3 Days) Focus: Command-Line Automation, Security Diagnostics, and Application Layer Troubleshooting
Day 1: Command-Line Automation and Advanced Filtering
Module 1: Command-Line Capture and Manipulation Tools
- TShark for Analysis (Using TShark to analyze trace files and output data from the command line).
- Dumpcap for Capture (Using Dumpcap for high-performance Command-Line capture).
- Trace File Statistics (Using the Capinfos Command-Line Tool to query capture file metadata).
- File Editing (Modifying trace files with Editcap Command-Line Tool (e.g., stripping packets, time shifting)).
- File Merging (Combining multiple captures with Mergecap Command-Line Tool).
Module 2: Capture File Management
- File Splitting (Techniques to Split and Merge Trace Files for focused analysis).
- Text Conversion (Creating capture files from text output using Text2pcap Command-Line Tool).
Module 3: Advanced Filter Implementation
- Advanced Capture Filters
- Capture filters scripts
- Advanced Display Filters
Module 4: The Expert System Advanced Usage
- Baselining (Establishing and comparing Baseline network communications).
- Congestion Diagnostics (Dealing with network congestion—identifying symptoms like shattered windows and flooding).
- Fragmentation issues in TCP/IP
- Case Studies (Lab exercises and case studies applying expert system analysis).
- Anomaly Detection (Identifying Unusual network communications that deviate from the baseline)
Module 5: Reconnaissance and Network Mapping
- Traffic Identification (Who is talking?—Identifying top talkers and connections).
- Scan Detection (Identifying and analyzing Port Scans, Mutant Scans, and IP Scans).
- Network Discovery (Performing Application Mapping).
- Host Identification (Techniques for OS Fingerprinting via network traces).
- Case Studies (Lab exercises and case studies on detecting probing behavior).
Day 2: Reconnaissance, and Application Analysis
Module 6: TCP/IP and Transport Layer
- IP Networking
- TCP Protocol
- Transport Layer analysis and troubleshooting
Module 7: Application Layer Troubleshooting
- Web Services (HTTP analysis and troubleshooting—latency, status codes, persistent connections).
- File Transfer (FTP analysis and troubleshooting—control and data channel issues).
- Name Resolution (DNS operation and troubleshooting—caching, resolution failures, query analysis).
Day 3: Network Security and Forensics
Module 8: Network Security and Forensics Basics
- Information Gathering (Gather information – what to look for in a security investigation).
- Pattern Recognition (Identifying Unusual traffic patterns indicative of compromise).
- Tool Integration (Integrating analysis with Complementary tools).
Module 9: Detecting Security Suspicious Patterns
- Address Deception (Detecting MAC and IP address spoofing).
- ARP Attacks (Identifying and analyzing ARP poisoning attempts).
- TCP Anomalies (Analyzing Header and sequencing signatures, TCP splicing and unusual traffic).
- Malicious Traffic (Detecting maliciously malformed packets).
Module 10: Advanced Attack Analysis
- Exploits (Analyzing traces for signatures of Attacks and exploits).
- Availability Attacks (Analyzing signatures for DoS and DDoS Attacks).
- Scanning Behavior (Identifying Protocol scans).
- Forensics Labs (Lab exercises and case studies on identifying post-compromise activity).