Masterclass - Advanced Network & Intro to Security Analysis -

Masterclass – Advanced Network & Intro to Security Analysis

Category: Wireshark training

Format: Open Classroom / Virtual / In-house

The realities of modern traffic analysis require interpreting encrypted network traffic correctly. A detailed knowledge of how key protocols such as HTTP can provide valuable insights into what is happening in a suspect traffic capture. This workshop provides an introduction.. read more below

Amsterdam / In-House / Virtual

duration: 5 days

5-12 class size

English

No data available yet.

Or you interested in this course? Request more information.

Specialized software configuration and new Wireshark Profiles to make Analysis faster
Encryption techniques, including SSL / TLS / WEP / WPA.x
Specialized encrypted traffic analysis techniques using Wireshark 4.x
Specialized filtering and Analysis techniques, including data traffic reconstruction and viewing
Recognition, analysis, and threat recognition for many of the following generation user protocol issues, including DHCPv6, IPv6/Ipv10, ICMPv6, SCTP/DCCP/RUDP, DNSSec/MDNS/DDNS/LLMNR, Email Protocols (POP / SMTP / IMAP), and standard Internet-based User Protocols such as HTTP2/HTTP3/QUIC

The course uses Real-world examples and numerous hands-on exercises to provide field-proven, practical analysis skills. Attendees receive a student guide, including numerous reference files, Networking and forensics tools, and a library of reference documents.

What is the purpose of this class?

This course fills the need for developing trained and experienced advanced network analysis personnel and introduces the field of Network Forensic analysis. By the end of this course, you will have the skills and knowledge to excel in your role and make significant contributions to your organization’s network security.

Target Audience:

Networking, Government, and Security personnel who need to develop advanced packet investigation techniques by studying the Next-Generation Networking Protocols using Wireshark. Completing this course provides these individuals with a pathway into network and forensics analysis.

Recommended Prerequisites:

Completion of WS 1 or equivalent Wireshark, network infrastructure, and protocol experience is required to ensure that all participants have a solid foundation in network analysis before diving into the advanced topics covered in this course.

Section 1: Introduction to Advanced Network Analysis

Logistics
Open-Source Tool Recommendations
Network Analysis Challenges – Nomenclature, Terminology, and Next Generation Protocols

Section 2: Recap: Collecting the Data – Data Capture

Taking it to the Next Level – Advanced Profile Construction

Data Collection
Configuring Wireshark – Standard Captures vs. Stealth and Silent Collection of Data
New types of capture filters – Offset and String-Matching

Section 3: Network Analysis Methodology

Analyzing Conversations and Activities for Indicators of Compromise (IOC)
Analyzing Conversations and Activities using the Expert Systems to determine unusual activity
Determining Which Conversations Are Suspect – Analyzing Latency and Throughput to recognize Suspicious Traffic
Advanced Network Forensic Methodology
Answering the key questions – A Sample Network Analysis Methodology
Forensic Diagramming – A Picture is worth 1024 Words
What’s Normal vs. Abnormal – The Role of Baseline Files
Building a Baseline Library – Where do I find Samples?
Recognizing Indications of Intrusions
Forensic Analysis of an Intrusion
Scouting the Target – Network Reconnaissance and Scanning Tools
Recognizing Scanning Signatures of standard scanning tools – NMAP, Nessus, Retina, and others
Bot, Botnets – Command and Control Traffic
Recognizing Bots and Botnet activity – the critical IOC’s
Identifying, tracking, and reassembling Command and Control Traffic

Section 4: Structure and Analysis of The Next Generation Application and User Traffic

The Networking Protocols – Original vs. Next Generation Protocols

Configuration Protocols – DHCPv6
Common DHCP-based exploits, Attacks and Examples of Intrusion Signatures
Resolving Addresses – DNSSec / DDNS / MDNS / LLMNR
Common DNS-type Exploits, Attacks, and Examples of Intrusion Signatures
The Network Layer – IPv6 / IPv10
Common IP Exploits and Examples of Intrusion Signatures
Utility and Troubleshooting Protocols – Internet Control Message Protocol (ICMPv6)
Common ICMP Exploits and Examples of Intrusion Signatures
The Transport Layer – Moving the Data –SCTP / RUDP / DCCP / QUIC / SPDY
Common Transport Layer Exploits and Examples of Intrusion Signatures
The Application Layer – Analyzing Common User Protocols
Email Applications Using POP / SMTP / IMAP
Structure and Analysis of the Email Cloud
Assembling and evaluating Email traffic
Web-Based Applications Using HTTP2 / HTTP3
Structure and Analysis of HTTPS – Decrypting TLS
Extracting and using Session Keys
Response Codes – The answer to analyzing HTTP-based protocols
Reassembling and Exporting of Objects

Student qoutes

" I found Phill to be the best teacher, and I learn so much from him. Thank you Phill"

- Paul Broyd

Course: TCP/IP Analysis and Troubleshooting with Wireshark

"It's sure the most interesting course that i have followed"

- Karin van der Plas

Course: TCP/IP Analysis and Troubleshooting with Wireshark

"It was a very very very interesting course, and done by the top guy"

- Matthew Steenwijk

Course:

"It was a real pleasure to receive the Wireshark training from a very dedicated trainer"

- Wim de Vries

Course: Voice & Video over IP Network Analysis

"I thought I already knew Wireshark. I was wrong, very wrong"

- Jeroen Valkonet

Course: TCP/IP Analysis and Troubleshooting with Wireshark

"This course is a must have for everyone in IT"

- Johan den Besten

Course: TCP/IP Analysis and Troubleshooting with Wireshark

"Great for network analyses or forensic investigations"

- Sven Schneider

Course: Masterclass – Advanced Network & Intro to Security Analysis

"By far the very best course I ever took"

- Joachim van Doeselaar

Course: TCP/IP Analysis and Troubleshooting with Wireshark

"If there’s a packet, it can be WireSharked!!"

- Elena Petrova

Course: WiFi & Wireless Network Analysis Using Wireshark

"Extremely satisfied with the training. Very helpful instructor and great teaching methods"

- Lars Mikkelsen

T.B.A.

TCP/IP Analysis and Troubleshooting with Wireshark Effective TCP/IP network analysis and optimization requires more than capturing network traffic. Network professionals need to understand how to interpret packets, identify communication patterns,..