Explore Products

Best Sellers

New Releases

Books

Videos

Audiobooks

Learning Hub

Free Learning

Hands-On Network Forensics: Investigate network attacks and find evidence using common network forensic tools

Nipun Jaswal

€32.99

3.2 (6 Ratings)

Paperback Mar 2019 358 pages 1st Edition

Nipun Jaswal

€32.99

3.2 (6 Ratings)

Paperback Mar 2019 358 pages 1st Edition

What do you get with Print?

Instant access to your digital eBook copy whilst your Print order is Shipped

Paperback book shipped to your preferred address

Download this book in EPUB and PDF formats

Access this title in our online reader with advanced features

DRM FREE - Read whenever, wherever and however you want

AI Assistant (beta) to help accelerate your learning

View table of contents

Preview Book

Key benefits

Investigate network threats with ease
Practice forensics tasks such as intrusion detection, network analysis, and scanning
Learn forensics investigation at the network level

Description

Network forensics is a subset of digital forensics that deals with network attacks and their investigation. In the era of network attacks and malware threat, it’s now more important than ever to have skills to investigate network attacks and vulnerabilities. Hands-On Network Forensics starts with the core concepts within network forensics, including coding, networking, forensics tools, and methodologies for forensic investigations. You’ll then explore the tools used for network forensics, followed by understanding how to apply those tools to a PCAP file and write the accompanying report. In addition to this, you will understand how statistical flow analysis, network enumeration, tunneling and encryption, and malware detection can be used to investigate your network. Towards the end of this book, you will discover how network correlation works and how to bring all the information from different types of network devices together. By the end of this book, you will have gained hands-on experience of performing forensics analysis tasks.

Who is this book for?

The book targets incident responders, network engineers, analysts, forensic engineers and network administrators who want to extend their knowledge from the surface to the deep levels of understanding the science behind network protocols, critical indicators in an incident and conducting a forensic search over the wire.

What you will learn

Discover and interpret encrypted traffic
Learn about various protocols
Understand the malware language over wire
Gain insights into the most widely used malware
Correlate data collected from attacks
Develop tools and custom scripts for network forensics automation

Estimated delivery fee Deliver to Switzerland

Standard delivery 10 - 13 business days

€11.95

Premium delivery 3 - 6 business days

€16.95

(Includes tracking information)

What do you get with Print?

Instant access to your digital eBook copy whilst your Print order is Shipped

Paperback book shipped to your preferred address

Download this book in EPUB and PDF formats

Access this title in our online reader with advanced features

DRM FREE - Read whenever, wherever and however you want

AI Assistant (beta) to help accelerate your learning

Estimated delivery fee Deliver to Switzerland

Standard delivery 10 - 13 business days

€11.95

Premium delivery 3 - 6 business days

€16.95

(Includes tracking information)

Product Details

Publication date : Mar 30, 2019

Length: 358 pages

Edition : 1st

Language : English

ISBN-13 : 9781789344523

Category :

Cloud & Networking

Languages :

Concepts :

Forensics

Tools :

Wireshark

Frequently bought together

Digital Forensics and Incident Response

Jan 2020 448 pages

4.6 (5)

eBook

€8.99 ~~€35.99~~

Hands-On Network Forensics

Mar 2019 358 pages

3.2 (6)

eBook

€8.99 ~~€26.99~~

Mastering Malware Analysis

Jun 2019 562 pages

4.5 (10)

eBook

€8.99 ~~€32.99~~

Total € 119.97

€44.99

€32.99

€41.99

Total € 119.97

15 Chapters

Section 1: Obtaining the Evidence

Introducing Network Forensics

Technical requirements

Network forensics investigation methodology

Source of network evidence

Wireshark essentials

Exercise 1 – a noob's keylogger

Exercise 2 – two too many

Summary

Questions and exercises

Further reading

Technical Concepts and Acquiring Evidence

Technical requirements

The inter-networking refresher

Log-based evidence

Case study – hack attempts

Summary

Questions and exercises

Further reading

Section 2: The Key Concepts

Deep Packet Inspection

Technical requirements

Protocol encapsulation

Analyzing packets on TCP

Analyzing packets on UDP

Analyzing packets on ICMP

Case study – ICMP Flood or something else

Summary

Questions and exercises

Further reading

Statistical Flow Analysis

Technical requirements

The flow record and flow-record processing systems (FRPS)

Sensor deployment types

Combatting Tunneling and Encryption

Technical requirements

Decrypting TLS using browsers

Decoding a malicious DNS tunnel

Decrypting 802.11 packets

Decoding keyboard captures

Summary

Questions and exercises

Further reading

Section 3: Conducting Network Forensics

Investigating Good, Known, and Ugly Malware

Technical requirements

Dissecting malware on the network

Intercepting malware for fun and profit

Behavior patterns and analysis

A real-world case study – investigating a banking Trojan on the network

Summary

Questions and exercises

Further reading

Investigating C2 Servers

Technical requirements

Decoding the Metasploit shell

Case study – decrypting the Metasploit Reverse HTTPS Shellcode

Analyzing Empire C2

Case study – CERT.SE's major fraud and hacking criminal case, B 8322-16

Summary

Questions and exercises

Further reading

Investigating and Analyzing Logs

Technical requirements

Network intrusions and footprints

A case study – defaced servers

Summary

Questions and exercises

Further reading

WLAN Forensics

Technical requirements

The 802.11 standard

Packet types and subtypes

Locating wireless devices

Identifying rogue access points

Identifying attacks

Case study – identifying the attacker

Summary

Questions

Further reading

Automated Evidence Aggregation and Analysis

Technical requirements

Automation using Python and Scapy

Automation through pyshark – Python's tshark

Merging and splitting PCAP data

Large-scale data capturing, collection, and indexing

Summary

Questions and exercises

Further reading

Other Books You May Enjoy

Leave a review - let other readers know what you think

Assessments

Chapter 1: Introducing Network Forensics

Chapter 6: Investigating Good, Known, and Ugly Malware

Chapter 7: Investigating C2 Servers

Chapter 9: WLAN Forensics

Recommendations for you

Mastering Terraform

Jul 2024 494 pages

5 (17)

eBook

€8.99 ~~€29.99~~

Building Resilient Architectures on AWS

Dec 2024 346 pages

eBook

€8.99 ~~€26.99~~

Platform Engineering for Architects

Oct 2024 374 pages

eBook

€8.99 ~~€29.99~~

Kubernetes – An Enterprise Guide

Aug 2024 682 pages

5 (11)

eBook

€8.99 ~~€32.99~~

Modern Network Observability

Oct 2024 506 pages

4 (5)

eBook

€8.99 ~~€29.99~~

AWS Cloud Projects

Oct 2024 266 pages

eBook

€8.99 ~~€23.99~~

Cloud Observability with Azure Monitor

Nov 2024 368 pages

eBook

€8.99 ~~€26.99~~

Solutions Architect's Handbook

Mar 2024 578 pages

4.7 (54)

eBook

€8.99 ~~€35.99~~

Cloud-Native - Microservices, Kubernetes, Service Mesh, CI/CD

Nov 2024 24hrs

Video

€8.99 ~~€59.99~~

Managing Kubernetes Resources Using Helm

Sep 2022 310 pages

5 (3)

eBook

€8.99 ~~€31.99~~

People who bought this also bought

AWS for Solutions Architects

Apr 2023 692 pages

4.3 (64)

eBook

€8.99 ~~€32.99~~

Ansible for Real-Life Automation

Sep 2022 480 pages

3.9 (7)

eBook

€8.99 ~~€25.99~~

Mastering Kubernetes

Jun 2023 746 pages

4.5 (47)

eBook

€8.99 ~~€32.99~~

The Ultimate Docker Container Book

Aug 2023 626 pages

4.5 (12)

eBook

€8.99 ~~€29.99~~

Mastering Ubuntu Server

Sep 2022 584 pages

4.7 (40)

eBook

€8.99 ~~€32.99~~

About the author

Nipun Jaswal

Nipun Jaswal is an international cybersecurity author and an award-winning IT security researcher with more than a decade of experience in penetration testing, Red Team assessments, vulnerability research, RF, and wireless hacking. He is presently the Director of Cybersecurity Practices at BDO India. Nipun has trained and worked with multiple law enforcement agencies on vulnerability research and exploit development. He has also authored numerous articles and exploits that can be found on popular security databases, such as PacketStorm and exploit-db. Please feel free to contact him at @nipunjaswal.

See other products by Nipun Jaswal

FAQs

What is the delivery time and cost of print book?

Shipping Details

USA:

Economy: Delivery to most addresses in the US within 10-15 business days

Premium: Trackable Delivery to most addresses in the US within 3-8 business days

UK:

Economy: Delivery to most addresses in the U.K. within 7-9 business days.
Shipments are not trackable

Premium: Trackable delivery to most addresses in the U.K. within 3-4 business days!
Add one extra business day for deliveries to Northern Ireland and Scottish Highlands and islands

EU:

Premium: Trackable delivery to most EU destinations within 4-9 business days.

Australia:

Economy: Can deliver to P. O. Boxes and private residences.
Trackable service with delivery to addresses in Australia only.
Delivery time ranges from 7-9 business days for VIC and 8-10 business days for Interstate metro
Delivery time is up to 15 business days for remote areas of WA, NT & QLD.

Premium: Delivery to addresses in Australia only
Trackable delivery to most P. O. Boxes and private residences in Australia within 4-5 days based on the distance to a destination following dispatch.

India:

Premium: Delivery to most Indian addresses within 5-6 business days

Rest of the World:

Premium: Countries in the American continent: Trackable delivery to most countries within 4-7 business days

Asia:

Premium: Delivery to most Asian addresses within 5-9 business days

Disclaimer:
All orders received before 5 PM U.K time would start printing from the next business day. So the estimated delivery times start from the next day as well. Orders received after 5 PM U.K time (in our internal systems) on a business day or anytime on the weekend will begin printing the second to next business day. For example, an order placed at 11 AM today will begin printing tomorrow, whereas an order placed at 9 PM tonight will begin printing the day after tomorrow.

Unfortunately, due to several restrictions, we are unable to ship to the following countries:

Afghanistan
American Samoa
Belarus
Brunei Darussalam
Central African Republic
The Democratic Republic of Congo
Eritrea
Guinea-bissau
Iran
Lebanon
Libiya Arab Jamahriya
Somalia
Sudan
Russian Federation
Syrian Arab Republic
Ukraine
Venezuela

What is custom duty/charge?

Customs duty are charges levied on goods when they cross international borders. It is a tax that is imposed on imported goods. These duties are charged by special authorities and bodies created by local governments and are meant to protect local industries, economies, and businesses.

Do I have to pay customs charges for the print book order?

The orders shipped to the countries that are listed under EU27 will not bear custom charges. They are paid by Packt as part of the order.

List of EU27 countries: www.gov.uk/eu-eea:

A custom duty or localized taxes may be applicable on the shipment and would be charged by the recipient country outside of the EU27 which should be paid by the customer and these duties are not included in the shipping charges been charged on the order.

How do I know my custom duty charges?

The amount of duty payable varies greatly depending on the imported goods, the country of origin and several other factors like the total invoice amount or dimensions like weight, and other such criteria applicable in your country.

For example:

If you live in Mexico, and the declared value of your ordered items is over $ 50, for you to receive a package, you will have to pay additional import tax of 19% which will be $ 9.50 to the courier service.
Whereas if you live in Turkey, and the declared value of your ordered items is over € 22, for you to receive a package, you will have to pay additional import tax of 18% which will be € 3.96 to the courier service.

How can I cancel my order?

Cancellation Policy for Published Printed Books:

You can cancel any order within 1 hour of placing the order. Simply contact customercare@packt.com with your order details or payment transaction id. If your order has already started the shipment process, we will do our best to stop it. However, if it is already on the way to you then when you receive it, you can contact us at customercare@packt.com using the returns and refund process.

Please understand that Packt Publishing cannot provide refunds or cancel any order except for the cases described in our Return Policy (i.e. Packt Publishing agrees to replace your printed book because it arrives damaged or material defect in book), Packt Publishing will not accept returns.

What is your returns and refunds policy?

Return Policy:

We want you to be happy with your purchase from Packtpub.com. We will not hassle you with returning print books to us. If the print book you receive from us is incorrect, damaged, doesn't work or is unacceptably late, please contact Customer Relations Team on customercare@packt.com with the order number and issue details as explained below:

If you ordered (eBook, Video or Print Book) incorrectly or accidentally, please contact Customer Relations Team on customercare@packt.com within one hour of placing the order and we will replace/refund you the item cost.
Sadly, if your eBook or Video file is faulty or a fault occurs during the eBook or Video being made available to you, i.e. during download then you should contact Customer Relations Team within 14 days of purchase on customercare@packt.com who will be able to resolve this issue for you.
You will have a choice of replacement or refund of the problem items.(damaged, defective or incorrect)
Once Customer Care Team confirms that you will be refunded, you should receive the refund within 10 to 12 working days.
If you are only requesting a refund of one book from a multiple order, then we will refund you the appropriate single item.
Where the items were shipped under a free shipping offer, there will be no shipping costs to refund.

On the off chance your printed book arrives damaged, with book material defect, contact our Customer Relation Team on customercare@packt.com within 14 days of receipt of the book with appropriate evidence of damage and we will work with you to secure a replacement copy, if necessary. Please note that each printed book you order from us is individually made by Packt's professional book-printing partner which is on a print-on-demand basis.

What tax is charged?

Currently, no tax is charged on the purchase of any print book (subject to change based on the laws and regulations). A localized VAT fee is charged only to our European and UK customers on eBooks, Video and subscriptions that they buy. GST is charged to Indian customers for eBooks and video purchases.

What payment methods can I use?

You can pay with the following card types:

Visa Debit
Visa Credit
MasterCard
PayPal

What is the delivery time and cost of print books?

Shipping Details

USA:

Economy: Delivery to most addresses in the US within 10-15 business days

Premium: Trackable Delivery to most addresses in the US within 3-8 business days

UK:

Economy: Delivery to most addresses in the U.K. within 7-9 business days.
Shipments are not trackable

Premium: Trackable delivery to most addresses in the U.K. within 3-4 business days!
Add one extra business day for deliveries to Northern Ireland and Scottish Highlands and islands

EU:

Premium: Trackable delivery to most EU destinations within 4-9 business days.

Australia:

India:

Premium: Delivery to most Indian addresses within 5-6 business days

Rest of the World:

Premium: Countries in the American continent: Trackable delivery to most countries within 4-7 business days

Asia:

Premium: Delivery to most Asian addresses within 5-9 business days

Unfortunately, due to several restrictions, we are unable to ship to the following countries:

Afghanistan
American Samoa
Belarus
Brunei Darussalam
Central African Republic
The Democratic Republic of Congo
Eritrea
Guinea-bissau
Iran
Lebanon
Libiya Arab Jamahriya
Somalia
Sudan
Russian Federation
Syrian Arab Republic
Ukraine
Venezuela

Hands-On Network Forensics: Investigate network attacks and find evidence using common network forensic tools

What do you get with Print?