Section 1: Introduction to Advanced Network Analysis
Logistics
Open-Source Tool Recommendations
Network Analysis Challenges – Nomenclature, Terminology, and Next Generation Protocols
Section 2: Recap: Collecting the Data – Data Capture
Taking it to the Next Level – Advanced Profile Construction
Data Collection
Configuring Wireshark – Standard Captures vs. Stealth and Silent Collection of Data
New types of capture filters – Offset and String-Matching
Section 3: Network Analysis Methodology
Analyzing Conversations and Activities for Indicators of Compromise (IOC)
Analyzing Conversations and Activities using the Expert Systems to determine unusual activity
Determining Which Conversations Are Suspect – Analyzing Latency and Throughput to recognize suspicious traffic
A Sample Advanced Network Forensic Methodology
Answering the key questions – A Sample Network Analysis Methodology
Forensic Diagramming – A Picture is worth 1024 Words
What’s Normal vs. Abnormal – The Role of Baseline Files
Building a Baseline Library – Where do I find Samples?
Recognizing IOCs of Intrusions
Forensic Analysis of an Intrusion
Scouting the Target – Network Reconnaissance and Scanning Tools
Recognizing Scanning Signatures of standard scanning tools – NMAP, Nessus, Retina, and others
Bot, Botnets – Command and Control Traffic
Recognizing Bots and Botnet activity – the key IOC’s
Identifying, tracking, and reassembling Command and Control Traffic
Section 4: Analysis of Network Applications and User Traffic – The Next Generation Networking Protocols
The Networking Protocols – Original vs. Next Generation – New Protocols and New Functions
Configuration Protocols
Structure and Analysis of DHCPv6
Common DHCP-based exploits, Attacks and Examples of Intrusion Signatures
Resolving Addresses – DNSSec / DDNS / MDNS / LLMNR
Structure and Analysis of DNS vs. DNSSec, DDNS. mDNS, and LMNR
Common DNS-type Exploits, Attacks, and Examples of Intrusion Signatures
The Network Layer – IPv6 / IPv10
Structure and Analysis of IPv4 vs. IPv6 and IPv10
IP Options – What’s the Big Deal?
Common IP Exploits and Examples of Intrusion Signatures
Utility and Troubleshooting Protocols – Internet Control Message Protocol (ICMPv6)
Structure and Analysis of ICMPv4 vs. ICMPv6
Network Analysis Using the ICMP Analysis – Types and Codes
Common ICMP Exploits and Examples of Intrusion Signatures
The Transport Layer – Moving the Data –SCTP / RUDP / DCCP / QUIC / SPDY
Structure and Advanced Analysis of TCP vs. UDP
TCP Options – What’s the Big Deal?
Advanced TCP Analysis Using Expert Systems
Structure and Advanced Analysis of SCTP
Structure and Analysis of the RUDP and DCCP
Google Transport Protocols SPDY / QUIC
Common Transport Layer Exploits and Examples of Intrusion Signatures
The Application Layer – Analyzing Common User Protocols
Email Applications Using POP / SMTP / IMAP
Structure and Analysis of the Email Cloud
Assembling and evaluating Email traffic
Web-Based Applications Using HTTP2 / HTTP3
Structure and Analysis of HTTPS – Decrypting TLS
Extracting and using Session Keys
Response Codes – The answer to analyzing HTTP-based protocols
Reassembling and Exporting of Objects
Where do I go from here? – Continuing Your Wireshark Education
Wireshark 0 – TCP/IP Networking Fundamentals Using Wireshark
Wireshark 1 – TCP/IP Troubleshooting & Network Optimization Using Wireshark
Wireshark 2 – Masterclass – Advanced Network & Security Analysis
Wireshark 3 – Network Forensics Analysis
Wireshark 4 – Mobile Device Forensics Analysis
Wireshark 5 – Cloud and Internet of Things (IoT) Advanced Network Analysis
Wireshark 6 – VoIP Advanced Network Analysis
Wireshark 7 – WiFi Advanced Network Analysis
Wireshark 8 – SCADA and ICS Advanced Network Analysis
Wireshark 9 – Wireshark Command Line Tools
