Section 1: Introduction to Advanced Network Analysis

Logistics

Open-Source Tool Recommendations

Network Analysis Challenges – Nomenclature, Terminology, and Next Generation Protocols

Section 2: Recap: Collecting the Data – Data Capture

Taking it to the Next Level – Advanced Profile Construction

Data Collection

Configuring Wireshark – Standard Captures vs. Stealth and Silent Collection of Data

New types of capture filters – Offset and String-Matching

Section 3: Network Analysis Methodology

Analyzing Conversations and Activities for Indicators of Compromise (IOC)

Analyzing Conversations and Activities using the Expert Systems to determine unusual activity

Determining Which Conversations Are Suspect – Analyzing Latency and Throughput to recognize suspicious traffic

A Sample Advanced Network Forensic Methodology

Answering the key questions – A Sample Network Analysis Methodology

Forensic Diagramming – A Picture is worth 1024 Words

What’s Normal vs. Abnormal – The Role of Baseline Files

Building a Baseline Library – Where do I find Samples?

Recognizing IOCs of Intrusions

Forensic Analysis of an Intrusion

Scouting the Target – Network Reconnaissance and Scanning Tools

Recognizing Scanning Signatures of standard scanning tools – NMAP, Nessus, Retina, and others

Bot, Botnets – Command and Control Traffic

Recognizing Bots and Botnet activity – the key IOC’s

Identifying, tracking, and reassembling Command and Control Traffic

Section 4: Analysis of Network Applications and User Traffic – The Next Generation Networking Protocols

The Networking Protocols – Original vs. Next Generation – New Protocols and New Functions

Configuration Protocols

Structure and Analysis of DHCPv6

Common DHCP-based exploits, Attacks and Examples of Intrusion Signatures

Resolving Addresses – DNSSec / DDNS / MDNS / LLMNR

Structure and Analysis of DNS vs. DNSSec, DDNS. mDNS, and LMNR

Common DNS-type Exploits, Attacks, and Examples of Intrusion Signatures

The Network Layer – IPv6 / IPv10

Structure and Analysis of IPv4 vs. IPv6 and IPv10

IP Options – What’s the Big Deal?

Common IP Exploits and Examples of Intrusion Signatures

Utility and Troubleshooting Protocols – Internet Control Message Protocol (ICMPv6)

Structure and Analysis of ICMPv4 vs. ICMPv6

Network Analysis Using the ICMP Analysis – Types and Codes

Common ICMP Exploits and Examples of Intrusion Signatures

The Transport Layer – Moving the Data –SCTP / RUDP / DCCP / QUIC / SPDY

Structure and Advanced Analysis of TCP vs. UDP

TCP Options – What’s the Big Deal?

Advanced TCP Analysis Using Expert Systems

Structure and Advanced Analysis of SCTP

Structure and Analysis of the RUDP and DCCP

Google Transport Protocols SPDY / QUIC

Common Transport Layer Exploits and Examples of Intrusion Signatures

The Application Layer – Analyzing Common User Protocols

Email Applications Using POP / SMTP / IMAP

Structure and Analysis of the Email Cloud

Assembling and evaluating Email traffic

Web-Based Applications Using HTTP2 / HTTP3

Structure and Analysis of HTTPS – Decrypting TLS

Extracting and using Session Keys

Response Codes – The answer to analyzing HTTP-based protocols

Reassembling and Exporting of Objects

Where do I go from here? – Continuing Your Wireshark Education

Wireshark 0 – TCP/IP Networking Fundamentals Using Wireshark

Wireshark 1 – TCP/IP Troubleshooting & Network Optimization Using Wireshark

Wireshark 2 – Masterclass – Advanced Network & Security Analysis

Wireshark 3 – Network Forensics Analysis

Wireshark 4 – Mobile Device Forensics Analysis

Wireshark 5 – Cloud and Internet of Things (IoT) Advanced Network Analysis

Wireshark 6 – VoIP Advanced Network Analysis

Wireshark 7 – WiFi Advanced Network Analysis

Wireshark 8 – SCADA and ICS Advanced Network Analysis

Wireshark 9 – Wireshark Command Line Tools