Summary

This module covers network packet analysis as a hands-on approach to understanding network communications, investigating security events, and identifying risks by examining packet headers and payloads.

By the end of this module, you will be able to:

Acquire a deep understanding of various network protocols, including TCP/IP, DNS, HTTP, and more
Enhance your network security skills by detecting and investigating security threats through packet analysis
Strengthen your ability to identify and mitigate potential vulnerabilities and risks in network systems
Acquire hands-on experience in interpreting packet headers and payloads for comprehensive network analysis

This module is broken into sections with accompanying hands-on exercises to practice each of the tactics and techniques we cover.

The following can be considered prerequisites for successful completion of this module:

Basic networking concepts such as IP addressing, subnetting, and routing
Familiarity with network protocols such as TCP/IP, DNS, and HTTP
Basic knowledge of operating systems and computer networks

Introduction to Network Packet Analysis

Network traffic analysis is the examination of the data packets that make up network traffic to detect any suspicious behavior.

Network traffic analysis is a guiding and life-saving tool for IT professionals in different disciplines in many areas such as detecting and solving problems related to network performance, controlling and auditing topology, and network security.

Whether you are a SOC analyst or Incident Responder, you are expected to have a solid understanding of all layers of the OSI model. This includes being familiar with the functions of these layers, knowing the protocol/packet structures at each layer, and more importantly, knowing how to collect, analyze and interpret the related content.

This module introduces fundamental approaches, tools, and their usage in network traffic analysis at an introductory level, essential for all cybersecurity SOC analysts.

In this module, you will learn the key features of WireShark, Tshark, NetworkMiner, and TcpDump, the most commonly used tools for packet capture, as well as some important tips for their use.

If you have not previously done so, we recommend that you finish the TCP/IP training before taking this module.

Candidates should complete all subjects in this module without missing any to practice the fundamentals at the end of the module.

First of all, we should clarify the "source of the traffic", which is a common issue for all the analysis tools we will cover in this training: All packet capturing software requires a "network card" and the traffic passing through it in order to serve its purpose. As you may remember from our previous TCP/IP training, an Ethernet card will receive packets with its own mac address by default. Therefore, before capturing traffic, we need to switch our Ethernet card to the promiscuous mode to ensure that all packets on the network are processed. The good news is that the products we will cover in this training will perform this process automatically in most cases.

There are also situations where we need to analyze traffic from more than one system. In such cases, we can configure a network device, through which the desired systems' network traffic flows, to send a duplicate copy of the traffic to the system running our analysis tool. This process is commonly referred to as port mirroring, although the terminology may vary depending on the specific device being used.

Sign Up / Log In to Unlock the Module

Please Sign Up or Log In to unlock the module and access the rest of the sections.

Sections

Introduction to Network Packet Analysis PREVIEW
TcpDump
Wireshark
Tshark
NetworkMiner
Network Packet Analysis (Quiz)

Relevant Paths

This module progresses you towards the following Paths

Google Cybersecurity Certificate Preparation

The Google Cybersecurity Certificate Preparation Path equips learners with the foundational knowledge and practical skills needed to succeed in the Google Cybersecurity Certificate and to build a credible footing for an entry-level cybersecurity role. The path moves from core security principles into the hands-on competencies that employers expect, covering cybersecurity best practices, scripting and Linux fundamentals, threat and vulnerability management, and the essentials of working with a SIEM.

Medium

224 Sections

Required: 1120

Reward: +240

24 Modules included

SOC Fundamentals

Mini-Module

Fundamental

10 Sections

Reward: +10

This module provides comprehensive coverage of SOC Fundamentals concepts and techniques. Topics covered include Common Mistakes made by SOC Analysts, EDR - Endpoint Detection and Response, Introduction to SOC, Log Management, SIEM and Analyst Relationship, and more.

Network Log Analysis

Mini-Module

Hard

10 Sections

Reward: +10

This module provides comprehensive coverage of Network Log Analysis concepts and techniques. Topics covered include DNS Log Analysis, Firewall Log Analysis, Generic Log Analysis (Netflow), IDSIPS Log Analysis, Introduction to Network Log Analysis, and more.

Network Packet Analysis

Mini-Module

Easy

6 Sections

Reward: +10 NEW

Delve into the art of network packet analysis in this comprehensive module. Gain essential skills to diagnose network issues, detect security threats, and optimize network performance. Learn protocols, tools, and techniques to capture, analyze, and interpret network traffic. Uncover hidden insights from packet headers and payloads, troubleshoot latency and congestion, and enhance network security. Whether you're a network administrator, security analyst, or IT professional, this module equips you with the knowledge and hands-on experience to excel in network packet analysis.

Introduction to Bash Scripting (LetsDefend)

Mini-Module

Medium

7 Sections

Reward: +10 NEW

This module is designed to provide detection engineers in the cybersecurity field with a foundational understanding of Bash scripting, enabling them to bolster their capabilities in threat detection and incident response.

Bash Scripting for Blue Team

Mini-Module

Hard

7 Sections

Reward: +10 NEW

The "Bash Scripting for Blue Team" module focuses on providing the essential scripting skills required for cybersecurity defense, specifically tailored for the Blue Team. It aims to equip individuals with the practical knowledge needed to proactively manage and defend against security threats.

Vulnerability Management

Mini-Module

Hard

7 Sections

Reward: +10 NEW

The "Vulnerability Management" module is a comprehensive training program focusing on identifying, assessing, and managing system vulnerabilities within the realm of cybersecurity. It offers in-depth insights into various vulnerability management strategies, techniques, and tools essential for building robust defense systems. Participants will gain practical knowledge to proactively identify, prioritize, and mitigate vulnerabilities, minimizing potential risks and fortifying cybersecurity measures effectively within organizational infrastructures. The module aims to empower cybersecurity professionals and IT personnel with the skills to protect systems against potential threats and enhance overall cybersecurity posture.

Introduction to Cryptology

Mini-Module

Medium

13 Sections

Reward: +10

This module provides comprehensive coverage of Introduction to Cryptology concepts and techniques. Topics covered include Base64 EncodingDecoding, Basic Concepts of Cryptology, Cryptographic Attacks, Digital Signatures, Hash Functions, and more.

Incident Response on Linux

Mini-Module

Medium

13 Sections

Reward: +10

Elevate your cybersecurity capabilities with our Incident Response on Linux module. This program provides thorough training on detecting, analyzing, and mitigating security threats in Linux environments. Tailored for IT professionals, system administrators, incident responders and security analysts, the module offers practical, hands-on experience to strengthen your incident response skills. By mastering essential tools and techniques, you’ll be equipped to safeguard networks and protect data effectively.

Incident Response on Windows

Mini-Module

Medium

13 Sections

Reward: +10

Enhance your cybersecurity expertise with our Incident Response on Windows module. Dive into essential techniques for detecting, analyzing, and mitigating security threats on Windows systems. Gain hands-on experience and practical knowledge to handle incidents swiftly and efficiently.

Introduction to Python

Mini-Module

Medium

10 Sections

Reward: +10 NEW

The "Introduction to Python" module is designed to familiarize detection engineers in cybersecurity with the Python programming language, enabling them to effectively apply it in the context of threat detection and analysis.

Python for Blue Team

Mini-Module

Hard

8 Sections

Reward: +10 NEW

The "Python for Blue Team" module focuses on equipping cybersecurity professionals within the Blue Team with practical Python skills tailored for effective threat detection and strategic defense methodologies.

Network Security

Mini-Module

Medium

10 Sections

Reward: +10 NEW

During this module section, we'll explore the intricacies of network security, focusing on practical security strategies and techniques to enhance your ability to protect digital systems effectively.

Network Design and Security Products

Mini-Module

Medium

11 Sections

Reward: +10 NEW

"Network Design and Security Products" is a comprehensive module focused on the intricate world of network architecture and the critical role security products play within it. This module delves into the strategic planning and implementation of robust network infrastructures, with an emphasis on security considerations. Students will gain insights into the fundamentals of network design, including network topologies, protocols, and scalability. They will also explore the latest advancements in security products, such as firewalls, intrusion detection systems, web application firewalls (WAF), and encryption technologies. Throughout the module, students will learn to assess potential network vulnerabilities and develop strategies to mitigate risks.

Network Fundamentals

Mini-Module

Fundamental

10 Sections

Reward: +10 NEW

This module provides comprehensive coverage of Network Fundamentals concepts and techniques. Topics covered include About Network Fundamentals Module, IP Addressing Mechanism, Introduction to Network Fundamentals, Network Address Translation (NAT), Network Devices, and more.

Network Fundamentals II

Mini-Module

Easy

12 Sections

Reward: +10 NEW

This module provides comprehensive coverage of Network Fundamentals II concepts and techniques. Topics covered include Address Resolution Protocol (ARP), Basic Concepts, Internet Control Message Protocol (ICMP), Internet Protocol (IP), Introduction to Network Fundamentals 2, and more.

Network Protocols

Mini-Module

Easy

8 Sections

Reward: +10 NEW

This module provides comprehensive coverage of Network Protocols concepts and techniques. Topics covered include Domain Name System (DNS) - 1, Domain Name System (DNS) - 2, Introduction to Network Protocols, Telnet (Teletype Network) Protocol, Transmission Control Protocol (TCP) - 1, and more.

Network Protocols - 2

Mini-Module

Easy

8 Sections

Reward: +10 NEW

This module will teach you how application-level protocols work and how you can use it as SOC Analyst or Incident Responder. As an investigator, you need to know the basics of these protocols to use it as evidence.

SIEM 101

Mini-Module

Fundamental

6 Sections

Reward: +10 NEW

This module provides comprehensive coverage of SIEM 101 concepts and techniques. Topics covered include Alerting, Log Aggregation and Parsing, Log Collection, Log Storage, SIEM Introduction.

Security Solutions

Mini-Module

Easy

14 Sections

Reward: +10

This module provides comprehensive coverage of Security Solutions concepts and techniques. Topics covered include Antivirus Software (AV), Asset Management Solutions, Data Loss Prevention (DLP), Email Security Solutions, Endpoint Detection and Response (EDR), and more.

Cybersecurity Incident Handling Guide

Mini-Module

Medium

6 Sections

Reward: +10

In this module, we will cover how to handle cybersecurity incidents properly, incident response processes with its proper order along with the recommendations of the "Computer Security Incident Handling Guide".

Security Audit and Testing

Mini-Module

Easy

6 Sections

Reward: +10 NEW

The "Security Audit and Testing" module offers a comprehensive understanding of assessing and enhancing digital security through rigorous auditing and testing procedures. Participants delve into techniques for identifying vulnerabilities, conducting risk assessments, and employing industry-standard tools to evaluate the resilience of networks, applications, and databases. Through practical applications and theoretical knowledge, students learn to interpret audit findings, prioritize security measures, and develop actionable strategies to mitigate risks effectively. This module equips learners with essential skills to safeguard sensitive information and maintain organizational integrity in today's interconnected digital environment.

Linux for Blue Team

Mini-Module

Fundamental

14 Sections

Reward: +10 NEW

This module provides comprehensive coverage of Linux for Blue Team concepts and techniques. Topics covered include About This Course, Archive File Formats, Basic Terminal Commands - 1, Basic Terminal Commands - 2, Introduction to Linux, and more.

Secure Network Design

Mini-Module

Medium

9 Sections

Reward: +10 NEW

The "Secure Network Design" module offers comprehensive insights into designing and implementing networks that prioritize security, equipping cyber people with the expertise to create resilient and protected digital infrastructures against evolving cyber threats. Through a blend of theoretical concepts and practical applications, participants will gain a deep understanding of network architecture, access controls, and risk management strategies, enabling them to develop and maintain secure communication channels within a dynamic and interconnected technological environment.

Job Hunting

Mini-Module

Medium

6 Sections

Reward: +10

This module provides comprehensive coverage of Job Hunting concepts and techniques. Topics covered include Getting Ready for the Interview, How and Where to Look for a Job, How to Prepare a Cybersecurity Resume, Introduction to Job Hunting, What Should You Expect, and more.