Network Forensics (2019)

2h 16mIntermediate2019-03-26

Authors

Jungwoo Ryoo

Teaches IT, cybersecurity, and risk analysis at Penn State

Course details

Network forensics is used to find legal evidence in network devices. In this course, Jungwoo Ryoo covers all of the major concepts and tools in this growing technical field. Jungwoo begins by reviewing the basics: the goals of network forensics, a network forensic investigator's typical toolset, and the legal implications of this type of work. Then, he shows how to prepare for an investigation; acquire network logs and investigate network events; collect and investigate network traffic; and leverage various network forensics tools, such as Wireshark, Splunk, and tcpdump. Along the way, he uses a combination of open-source and commercial software, so you can uncover the information you need with tools that are in your budget.

Learning objectives
Goals of network forensics
Using a syslog and Microsoft Log Parser
Investigating network traffic
How protocol analysis works
ARP and DNS poisoning
Working with network forensics tools
Using packet sniffers

Skills covered

WiresharkLinuxNetwork SecurityCybersecurityOpen SourceDeep Dive (X:Y)

Concepts

0. Introduction

01 - Learning network forensics
02 - What you should know

1. Understanding Network Forensics

03 - Goals of network forensics
04 - Tools
05 - Legal implications
06 - Current and future trends
07 - Anti-network forensics techniques

2. Preparing for a Network Forensics Investigation

08 - Network forensics investigation hardware
09 - Network forensics investigation software
10 - Understanding computer networking
11 - Understanding networking devices
12 - Understanding network data sources

Conclusion

39 - Next steps