Wireshark Network Forensics

ripoff · January 25, 2012

...and Security Video Trainings With Tools

This course focuses on network forensics including capture locations, stealth-mode capture,optimal capture and display filters, validating encrypted logins, identifying reconnaissance processes, locating header and payload signatures, catching penetration tests, malware behavior, backdoor communications and virus traffic.
Recommended prerequisite knowledge:
1. Basic security knowledge (resources, viruses, worms, denial of service)
2. Basic and advanced network components (hubs, switches, routers, firewalls, IDS)
3. Very strong knowledge of Wireshark functionality and features
4. Navigation
5. Capture filters and methods
6. Packet details (TCP/IP protocols and applications)
7. Display filtering on protocol or field or bit value
8. Search by display filter, hex value or string
9. Basic Wireshark graphs and tables (IO, conversations, endpoints)
10. Advanced Wireshark graphs (CALC, SEQ/ACK, RTT)
11. Save packets based on filters, markers or range value
12. Very strong knowledge of TCP/IP protocol and application functionality
13. Port usage and resolution
14. Name resolution (network and hardware address) and route resolution
15. ICMP functionality (packet structure, functionality)
16. TCP functionality (handshake, fault tolerance, recovery)
17. DNS functionality (address lookup, errors)
18. IP functionality (addressing, fragmentation)
19. ARP functionality (structure, functionality)
20. Follow TCP Streams
21. Expert Info/Expert Info Composite interpretation
Tools Kit:
-bittwist
-cain_abel
-commview
-comm_traffic
-essential_nettools
-ettercap
-ftk_imager
-kfsensor
-netresident
-netscantools_pro
-nmap
-wireshark