NetworkWireshark / Packet CaptureCapture, filter and read packets in Wireshark and tshark to recover what was sent.Network Traffic Analysis
Read flows, logs and packets to trace intrusions, beaconing and data theft.
- Intermediate
- Online or on campus
- 5 hands-on labs
- 7 modules
About this course
When a company finds that customer data has turned up on a leak site, the first question is simple. How did it leave? The answer is usually in the network records the company already has, if someone knows how to read them. Firewall logs, proxy logs, DNS logs, NetFlow and the odd packet capture each hold a part of the story.
This course teaches you to work with all of these sources together. You learn what NetFlow can and cannot tell you compared with full packet capture, how to turn raw traffic into Zeek logs that are quick to search, and how to spot the patterns that matter in a case. These include malware calling home at regular intervals, large uploads at odd hours and DNS queries that carry data out in their names.
The focus is on evidence that holds up. You hash and record every capture and log export, keep time zones straight and write findings that a manager, a police officer or a court can follow.
NetFlow and PCAPZeek logsBeaconingData exfiltration
After this course you can
- Explain the difference between NetFlow records and full packet capture and choose the right source for a case
- Collect firewall, proxy, DNS and DHCP logs and link an IP address to a device and a user at a given time
- Turn a packet capture into Zeek logs and search conn.log, dns.log, http.log and ssl.log for leads
- Spot beaconing by looking at connection intervals, sizes and destinations over time
- Recognise common exfiltration patterns such as bulk uploads, DNS tunnelling and transfers to cloud storage
- Build a timeline of network events and write it up as clear, defensible findings
Syllabus
7 modules · 28 topics
01Network evidence and where it lives4 topics
- The OSI and TCP/IP models from an investigator's point of view
- Evidence sources such as firewalls, proxies, DNS servers, DHCP servers, VPN gateways and NetFlow collectors
- Network taps compared with SPAN ports and why a busy SPAN port can drop packets
- Time sync, time zones and NTP drift between devices
02NetFlow compared with full packet capture4 topics
- What a flow record holds, such as addresses, ports, protocol, byte and packet counts and start and end times
- What it leaves out, mainly the payload and some detail when sampling is on
- NetFlow v5, v9 and IPFIX in practice
- When metadata is enough and when you need the full PCAP
03Reading firewall, proxy and DNS logs4 topics
- Allow and deny entries, NAT translations and what they mean for attribution
- Proxy logs: URLs, user agents, categories and authenticated user names
- DNS query logs and passive DNS for tracing short-lived domains
- Linking a public IP to an internal host through NAT and DHCP lease records
04Zeek for investigators4 topics
- Running Zeek over a PCAP and the logs it produces
- Following one connection across logs with the uid field
- Finding odd TLS certificates, rare user agents and new domains
- Extracting files seen on the wire with files.log
05Beaconing and command-and-control4 topics
- Why malware calls home and what a beacon looks like in flow data
- Interval, jitter and payload size as signs of automated traffic
- Using RITA on Zeek logs to rank likely beacons
- Ruling out normal software updates and telemetry
06Exfiltration patterns4 topics
- Large outbound transfers and unusual upload to download ratios
- DNS tunnelling: long subdomains, high query counts and TXT records
- Uploads to file-sharing and cloud storage services
- Staging, compression and transfers at night or on holidays
07Preserving and reporting network evidence4 topics
- Hashing captures and log exports and recording how they were collected
- Chain of custody for network data that has no physical exhibit
- Building a single timeline from many log sources
- Writing findings for technical and non-technical readers
Hands-on labs
- Lab 1
Trace an internal host from a public IP address using firewall NAT logs and DHCP leases
- Lab 2
Run Zeek over a capture from a simulated office breach and find the first malicious connection
- Lab 3
Detect a beaconing host in a week of flow data and confirm it in the packets
- Lab 4
Find data leaving through DNS tunnelling and estimate how much was taken
- Lab 5
Build a timeline of the intrusion and write a two-page findings note
Tools you will use
- Zeek
- Wireshark
- NetworkMiner
- RITA
- Suricata
- nfdump
- Elastic Stack (ELK)
Who it suits
- SOC analysts who want to move from alerts to investigation
- Police and cybercrime cell staff who handle IP address and log requests
- Network and system administrators in companies
- Forensics students ready to go beyond disk analysis
Before you join
- Working knowledge of IP addresses, ports and common protocols such as DNS and HTTP
- Comfort with the command line on Windows or Linux
- Basics of Cyber Forensics or similar knowledge helps
Questions about this course
Do I need to know Wireshark before this course?
No. You use Wireshark here to check leads, but the main focus is on logs and flows. If you want a deep start on packets, take Wireshark / Packet Capture alongside or before this course.
Will this help me with real cases where there is no packet capture?
Yes. Most organisations do not keep full captures. A large part of the course is about getting answers from firewall, proxy, DNS and flow logs, which are what you usually get in a real case.
Is this course useful for corporate incident response or only for police work?
Both. The methods are the same. Only the reporting changes, and the course covers writing for an internal team as well as for an investigating officer.
More courses in Network & Cloud Forensics
NetworkWireshark / Packet CaptureCapture, filter and read packets in Wireshark and tshark to recover what was sent.
NetworkCloud Storage InvestigationCollect and read AWS, Microsoft 365 and Google Workspace logs as sound evidence.
NetworkVirtual Machine / Hypervisor ForensicsExamine VMDK, VHDX and QCOW2 disks, snapshots, ESXi logs and VM memory files.Not sure this is the right one for you?
Tell us your background and what you want to do next. A counsellor will suggest a course and the next batch.