After completing the Cybersécurité et analyse médico-légale des réseaux course, participants will be able to apply a structured methodology to network forensic investigations and use Wireshark to analyze network traffic and PCAP files.

Network Forensics Fundamentals

• Understand the principles of network forensics.
• Understand network forensic terminology and methodology.
• Identify the role of packet captures as network evidence.
• Understand the difference between real-time and post-capture analysis.
• Apply a structured approach to network forensic investigations.

Network Traffic Collection

• Configure Wireshark for network investigations.
• Select appropriate capture interfaces.
• Understand capture filters.
• Collect relevant network traffic.
• Work with multiple packet captures.
• Identify and preserve traffic relevant to an investigation.

Packet and Protocol Analysis

• Analyze IPv4 and IPv6 communications.
• Investigate ARP, DHCP, DNS, TCP, UDP and ICMP traffic.
• Analyze HTTP and other application-layer protocols.
• Understand normal protocol behavior.
• Identify protocol anomalies.
• Interpret packet-level information in a forensic context.

Wireshark Filtering and Investigation

• Use Wireshark display filters effectively.
• Use capture filters.
• Filter traffic by IP address, host, protocol and port.
• Identify conversations between systems.
• Follow TCP streams.
• Locate relevant packets in large PCAP files.
• Apply advanced filtering techniques during investigations.

Network Conversation Reconstruction

• Identify communicating systems.
• Reconstruct network conversations.
• Follow application-level communications.
• Analyze TCP connection establishment and termination.
• Understand communication sequences.
• Reconstruct events from packet captures.
• Build a timeline of relevant network activity.

Detecting Suspicious Network Activity

• Distinguish normal from unusual network behavior.
• Identify suspicious communication patterns.
• Investigate network scanning and reconnaissance.
• Identify suspicious connections.
• Analyze malware-related network traffic.
• Investigate command-and-control communications.
• Analyze data transfers and potential data exfiltration.
• Identify indicators of compromise.
• Recognize abnormal protocol behavior.

Cybersecurity Incident Investigation

• Investigate potentially compromised systems.
• Analyze suspicious network behavior.
• Identify evidence of attack activity.
• Examine network communications before, during, and after an incident.
• Correlate network activity with investigation findings.
• Extract relevant evidence from PCAP files.
• Apply a structured methodology to incident investigations.

Advanced Network Forensic Analysis

• Perform traffic reconstruction.
• Analyze network conversations and communication patterns.
• Recognize relevant traffic within large captures.
• Reconstruct timelines from network traffic.
• Analyze network behavior.
• Interpret packet-level evidence.
• Document and communicate forensic findings.

Practical Outcome

At the end of the course, participants will be able to start with a network capture, systematically identify relevant traffic, isolate suspicious communications, reconstruct network activity, and use packet-level evidence to support a cybersecurity or forensic investigation.

They will have developed practical skills for using Wireshark for network forensics, PCAP analysis, incident response, cybersecurity investigations, and network traffic analysis.