Network Forensics

Network forensics is used to find legal evidence in network devices. This course covers all the major concepts and tools of this growing (and exciting) technical field. Instructor Jungwoo Ryoo reviews the basics: the goals of network forensics, the types of investigations it's used for, a network forensic investigator's typical toolset, and the legal implications of this type of work. Then, he'll show how to prepare for an investigation; acquire network logs and investigate network events; collect and investigate network traffic; investigate web attacks; and create a report of your findings. He uses a combination of open-source and commercial software, so you'll be able to uncover the information you need with the tools that are in your budget.

Learning objectives
Describe the career opportunities and skills/knowledge required to be a successful network forensics professional.
Use network forensics tools for acquiring evidence, especially logging, such as syslog, syslog-ng, and Microsoft log parser.
Use network forensics tools such as Wireshark for packet/protocol analysis.
Explain network forensics certification opportunities and identify the ones to pursue.
Produce a comprehensive network forensics investigation report both manually and using automated tools.