Network Forensics and Investigation I Training
Network Traffic Analysis will teach you to differentiate between normal and abnormal network traffic, track the flow of packets through a network, and attribute conversations and actions taken over a network segment to specific hosts or users. This course focuses on research, filtering, and comparative analysis to identify and attribute the different types of activity on a network.
Network Forensics and Investigation I
Course Overview
You will learn how to follow conversations across a wide range of protocols and through redirection, as well as how to develop custom filters for non-dissected protocols. On Day 5 of the course, you will participate in a team-based capture-the-flag exercise to test your new skills. You will learn:
- Create a baseline of the protocols, hosts and interactions in a network
- environment
- Identify anomalous network traffic using a combination of in-depth packet
- analysis and high-level statistical analysis
- Reconstruct event timelines and accurately correlate, or distinguish between,
- event threads
- Identify and extract network artifacts for further forensic analysis
- Compare observed network traffic to expected topology
- Research and analyze unknown (non-dissected) protocols
- Track web activity at the user or session level via HTTP header analytics
Course Outline
- 1. Building Blocks
- 2. OSI &TCP/IP Review
- 3. Wireshark Tutorial
- 4. Day in the Life (Common Protocols)
- 5. Extracting Objects
- 6. TCP – A Deeper Look
- 7. Analytic Approach
- 8. Internet Research
- 9. Isolating Traffic
- 10. Routing Principles
- 11. Traceroute Analysis
- 12. Standards and Protocol Analysis
- 13. Start-to-Finish Protocol
- 14. Analysis (Email Example)
- 15. Analysis Beyond Wireshark
- 16. Secure Protocols
- 17. HTTP Header Analytics
- 18. Big Capture
- 19. More Tools and Tricks
- Labs
- 1. Wireshark Filtering (Part 1, Part 2)
- 2. A Day in the Life (Common Protocols)
- 3. Exporting Objects
- 4. TCP/IP Analysis
- 5. Internet Research
- 6. Isolate Event #1
- 7. Isolate Event #2
- 8. Isolate Event #3
- 9. Isolate Event #4
- 10. Isolate Event #5
- 11. RFC Research
- 12. Meta-data Analysis
- 13. Non-Dissected Protocol Analysis
- 14. Encrypted Traffic Analysis Referer
- 15. User-Agents
- 16. Web Request Tracking
- 17. Large Capture Investigation
Using the tools, skills, and methodologies taught in Days 1 – 4, on day 5 of the course students will participate in a competitive capture-the-flag exercise that includes various categories, including a simulated SCADA attack scenario. Designed to challenge the participants, each correctly completed milestone will unlock a successively more difficult challenge.
Intended Audience
- Network analysts seeking to develop security-related skills
- Incident responders needing to quickly address system security breaches
- Penetration testers looking to reduce their detectability
- Threat operations analysts seeking a better understanding of network
- intrusions
- All network administrators needing a better understanding of network security
Prerequisites
- A broad understanding of TCP/IP and associated protocols
- Knowledge of network hardware and segment types
- Previous exposure to Wireshark or other protocol analysis software is also
- recommended
Follow-On Courses
Related training topics
Justify your training
Use this sample request letter — copy it into an email to your manager and personalize the bracketed details to make the case for the time and budget.
Sample training request letter
Subject: Request for Digital Forensics & Reverse Engineering training from Applied Technology Academy
[Decision Maker Name],
I'm writing to request time and budget approval to complete Applied Technology Academy's course, Network Forensics and Investigation I Training. The information below outlines how this training benefits our organization, the tasks I'll be able to perform after completing it, and relevant cost and funding details.
Course Description
Network Traffic Analysis will teach you to differentiate between normal and abnormal network traffic, track the flow of packets through a network, and attribute conversations and actions taken over a network segment to specific hosts or users. This course focuses on research, filtering, and comparative analysis to identify and attribute the different types of activity on a network. Applied Technology Academy is an award-winning, SBA-certified woman-owned training provider (est. 2008) whose instructors are active practitioners; the course is hands-on with virtual labs and a learn-by-doing methodology.
Course Objectives
Once I've completed the course, I'll have hands-on, job-ready skills in digital forensics & reverse engineering that I can apply immediately to our work.
Expected Organizational Benefits
After completing this course, I will be better equipped to apply these skills directly to our projects, reduce our reliance on outside expertise, strengthen our team's capabilities, and share what I learn with colleagues.
Expected Cost & Funding
Course fee: [request an itemized quote at the link below]. Applied Technology Academy supports multiple funding paths that may reduce or cover this cost: GSA MAS purchasing and government purchase orders, military credentialing funding (Army CA, AF COOL, CG COOL), VA GI Bill and VR&E, ATA Flexible Spending, and student financing. Private team cohorts are available if colleagues should attend with me.
Conclusion
This training provides practical, hands-on experience I can apply immediately to strengthen our work in digital forensics & reverse engineering. Additional course information is available at https://appliedtechnologyacademy.com/network-forensics-and-investigation-i/.
Thank you for your consideration,
[Your Name]
Related Digital Forensics & Reverse Engineering courses
Design training around your team, not the other way around.
Talk to a training advisor about private cohorts, funding paths and program management.