Network Traffic Analysis

Sophisticated attackers can go undetected in a victim’s network for an extended period. Attackers can blend their traffic with legitimate traffic that only skilled network analysts know how to detect. This course teaches how to identify malicious network activity.

The course provides an overview of network protocols, network architecture, intrusion detection systems, network traffic capture, and traffic analysis. Learners can review the types of network monitoring and the tools commonly used to analyze captured network traffic. The course also explores the best techniques for investigating botnets and how to use honeypots in network monitoring.

The course includes lectures and hands-on lab sessions to reinforce technical concepts.

Prerequisites: A basic understanding of TCP/IP, Windows, and UNIX platforms. Familiarity with security terminology and a working knowledge of Wireshark is also recommended.

After completing the course, learners should be able to:

• Understand the network monitoring and incident response processes, and why it’s critical in today’s network environments
• Discuss the pros and cons of statistical, connection, full content, event monitoring, and tools
• Perform event-based monitoring using Snort
• Minimize network traffic with the Snort rule structure and custom rule creation
• Review Snort alerts using the Sguil front end

Information technology and security staff, corporate investigators, and other staff members who need to understand networks, network traffic, network traffic analysis, and network intrusion investigations.

In-classroom, virtual instructor-led training, and web-based training

• 3 days (in-person delivery)
• 4 days (virtual delivery)

Students are required to bring their own laptop that meets the following specs:

• Windows 7+
• Core i5 or equivalent processor
• 6 GB (preferably 8 GB) of RAM
• 25 GB free HDD space
• Virtual machines are acceptable provided at least 4 GB of RAM can be allocated

Learners will receive a lab book and all required class materials and tools, and must be able to either boot from USB or have VMware Player.