Learning Network Forensics

Identify and safeguard your network against both internal and external threats, hackers, and malware attacks

Key Features

• Lay your hands on physical and virtual evidence to understand the sort of crime committed by capturing and analyzing network traffic
• Connect the dots by understanding web proxies, firewalls, and routers to close in on your suspect
• A hands-on guide to help you solve your case with malware forensic methods and network behaviors

Book Description

What you will learn

• Understand Internetworking, sources of network-based evidence and other basic technical fundamentals, including the tools that will be used throughout the book
• Acquire evidence using traffic acquisition software and know how to manage and handle the evidence
• Perform packet analysis by capturing and collecting data, along with content analysis
• Locate wireless devices, as well as capturing and analyzing wireless traffic data packets
• Implement protocol analysis and content matching; acquire evidence from NIDS/NIPS
• Act upon the data and evidence gathered by being able to connect the dots and draw links between various events
• Apply logging and interfaces, along with analyzing web proxies and understanding encrypted web traffic
• Use IOCs (Indicators of Compromise) and build real-world forensic solutions, dealing with malware

Who this book is for

If you are a network administrator, system administrator, information security, or forensics professional and wish to learn network forensic to track the intrusions through network-based evidence, then this book is for you. Basic knowledge of Linux and networking concepts is expected.