Explore Products

Best Sellers

New Releases

Books

Videos

Audiobooks

Learning Hub

Free Learning

Hands-On Network Forensics: Investigate network attacks and find evidence using common network forensic tools

Nipun Jaswal

₱579.99 ~~₱1796.99~~

3.2 (6 Ratings)

eBook Mar 2019 358 pages 1st Edition

Nipun Jaswal

₱579.99 ~~₱1796.99~~

3.2 (6 Ratings)

eBook Mar 2019 358 pages 1st Edition

What do you get with eBook?

Instant access to your Digital eBook purchase

Download this book in EPUB and PDF formats

Access this title in our online reader with advanced features

DRM FREE - Read whenever, wherever and however you want

AI Assistant (beta) to help accelerate your learning

View table of contents

Preview Book

Key benefits

Investigate network threats with ease
Practice forensics tasks such as intrusion detection, network analysis, and scanning
Learn forensics investigation at the network level

Description

Network forensics is a subset of digital forensics that deals with network attacks and their investigation. In the era of network attacks and malware threat, it’s now more important than ever to have skills to investigate network attacks and vulnerabilities. Hands-On Network Forensics starts with the core concepts within network forensics, including coding, networking, forensics tools, and methodologies for forensic investigations. You’ll then explore the tools used for network forensics, followed by understanding how to apply those tools to a PCAP file and write the accompanying report. In addition to this, you will understand how statistical flow analysis, network enumeration, tunneling and encryption, and malware detection can be used to investigate your network. Towards the end of this book, you will discover how network correlation works and how to bring all the information from different types of network devices together. By the end of this book, you will have gained hands-on experience of performing forensics analysis tasks.

Who is this book for?

The book targets incident responders, network engineers, analysts, forensic engineers and network administrators who want to extend their knowledge from the surface to the deep levels of understanding the science behind network protocols, critical indicators in an incident and conducting a forensic search over the wire.

What you will learn

Discover and interpret encrypted traffic
Learn about various protocols
Understand the malware language over wire
Gain insights into the most widely used malware
Correlate data collected from attacks
Develop tools and custom scripts for network forensics automation

What do you get with eBook?

Instant access to your Digital eBook purchase

Download this book in EPUB and PDF formats

Access this title in our online reader with advanced features

DRM FREE - Read whenever, wherever and however you want

AI Assistant (beta) to help accelerate your learning

Product Details

Publication date : Mar 30, 2019

Length: 358 pages

Edition : 1st

Language : English

ISBN-13 : 9781789341058

Category :

Cloud & Networking

Languages :

Concepts :

Network Security

Tools :

Wireshark

Frequently bought together

Digital Forensics and Incident Response

Jan 2020 448 pages

4.6 (5)

eBook

₱579.99 ~~₱2449.99~~

Hands-On Network Forensics

Mar 2019 358 pages

3.2 (6)

eBook

₱579.99 ~~₱1796.99~~

Mastering Malware Analysis

Jun 2019 562 pages

4.5 (10)

eBook

₱579.99 ~~₱2245.99~~

Total ₱ 8,114.97

₱3061.99

₱2245.99

₱2806.99

Total ₱ 8,114.97

15 Chapters

Section 1: Obtaining the Evidence

Introducing Network Forensics

Technical requirements

Network forensics investigation methodology

Source of network evidence

Wireshark essentials

Exercise 1 – a noob's keylogger

Exercise 2 – two too many

Summary

Questions and exercises

Further reading

Technical Concepts and Acquiring Evidence

Technical requirements

The inter-networking refresher

Log-based evidence

Case study – hack attempts

Summary

Questions and exercises

Further reading

Section 2: The Key Concepts

Deep Packet Inspection

Technical requirements

Protocol encapsulation

Analyzing packets on TCP

Analyzing packets on UDP

Analyzing packets on ICMP

Case study – ICMP Flood or something else

Summary

Questions and exercises

Further reading

Statistical Flow Analysis

Technical requirements

The flow record and flow-record processing systems (FRPS)

Sensor deployment types

Combatting Tunneling and Encryption

Technical requirements

Decrypting TLS using browsers

Decoding a malicious DNS tunnel

Decrypting 802.11 packets

Decoding keyboard captures

Summary

Questions and exercises

Further reading

Section 3: Conducting Network Forensics

Investigating Good, Known, and Ugly Malware

Technical requirements

Dissecting malware on the network

Intercepting malware for fun and profit

Behavior patterns and analysis

A real-world case study – investigating a banking Trojan on the network

Summary

Questions and exercises

Further reading

Investigating C2 Servers

Technical requirements

Decoding the Metasploit shell

Case study – decrypting the Metasploit Reverse HTTPS Shellcode

Analyzing Empire C2

Case study – CERT.SE's major fraud and hacking criminal case, B 8322-16

Summary

Questions and exercises

Further reading

Investigating and Analyzing Logs

Technical requirements

Network intrusions and footprints

A case study – defaced servers

Summary

Questions and exercises

Further reading

WLAN Forensics

Technical requirements

The 802.11 standard

Packet types and subtypes

Locating wireless devices

Identifying rogue access points

Identifying attacks

Case study – identifying the attacker

Summary

Questions

Further reading

Automated Evidence Aggregation and Analysis

Technical requirements

Automation using Python and Scapy

Automation through pyshark – Python's tshark

Merging and splitting PCAP data

Large-scale data capturing, collection, and indexing

Summary

Questions and exercises

Further reading

Other Books You May Enjoy

Leave a review - let other readers know what you think

Assessments

Chapter 1: Introducing Network Forensics

Chapter 6: Investigating Good, Known, and Ugly Malware

Chapter 7: Investigating C2 Servers

Chapter 9: WLAN Forensics

Recommendations for you

Mastering Terraform

Jul 2024 494 pages

5 (17)

eBook

₱579.99 ~~₱2040.99~~

Building Resilient Architectures on AWS

Dec 2024 346 pages

eBook

₱579.99 ~~₱1836.99~~

Platform Engineering for Architects

Oct 2024 374 pages

eBook

₱579.99 ~~₱2040.99~~

Kubernetes – An Enterprise Guide

Aug 2024 682 pages

5 (11)

eBook

₱579.99 ~~₱2245.99~~

Modern Network Observability

Oct 2024 506 pages

4 (5)

eBook

₱579.99 ~~₱2040.99~~

AWS Cloud Projects

Oct 2024 266 pages

eBook

₱579.99 ~~₱1632.99~~

Cloud Observability with Azure Monitor

Nov 2024 368 pages

eBook

₱579.99 ~~₱1836.99~~

Solutions Architect's Handbook

Mar 2024 578 pages

4.7 (54)

eBook

₱579.99 ~~₱2449.99~~

Cloud-Native - Microservices, Kubernetes, Service Mesh, CI/CD

Nov 2024 24hrs

Video

₱579.99 ~~₱4082.99~~

Managing Kubernetes Resources Using Helm

Sep 2022 310 pages

5 (3)

eBook

₱579.99 ~~₱2122.99~~

People who bought this also bought

AWS for Solutions Architects

Apr 2023 692 pages

4.3 (64)

eBook

₱579.99 ~~₱2245.99~~

Ansible for Real-Life Automation

Sep 2022 480 pages

3.9 (7)

eBook

₱579.99 ~~₱1714.99~~

Mastering Kubernetes

Jun 2023 746 pages

4.5 (47)

eBook

₱579.99 ~~₱2245.99~~

The Ultimate Docker Container Book

Aug 2023 626 pages

4.5 (12)

eBook

₱579.99 ~~₱2040.99~~

Mastering Ubuntu Server

Sep 2022 584 pages

4.7 (40)

eBook

₱579.99 ~~₱2245.99~~

About the author

Nipun Jaswal

Nipun Jaswal is an international cybersecurity author and an award-winning IT security researcher with more than a decade of experience in penetration testing, Red Team assessments, vulnerability research, RF, and wireless hacking. He is presently the Director of Cybersecurity Practices at BDO India. Nipun has trained and worked with multiple law enforcement agencies on vulnerability research and exploit development. He has also authored numerous articles and exploits that can be found on popular security databases, such as PacketStorm and exploit-db. Please feel free to contact him at @nipunjaswal.

See other products by Nipun Jaswal

FAQs

How do I buy and download an eBook?

Where there is an eBook version of a title available, you can buy it from the book details for that title. Add either the standalone eBook or the eBook and print book bundle to your shopping cart. Your eBook will show in your cart as a product on its own. After completing checkout and payment in the normal way, you will receive your receipt on the screen containing a link to a personalised PDF download file. This link will remain active for 30 days. You can download backup copies of the file by logging in to your account at any time.

If you already have Adobe reader installed, then clicking on the link will download and open the PDF file directly. If you don't, then save the PDF file on your machine and download the Reader to view it.

Please Note: Packt eBooks are non-returnable and non-refundable.

Packt eBook and Licensing When you buy an eBook from Packt Publishing, completing your purchase means you accept the terms of our licence agreement. Please read the full text of the agreement. In it we have tried to balance the need for the ebook to be usable for you the reader with our needs to protect the rights of us as Publishers and of our authors. In summary, the agreement says:

You may make copies of your eBook for your own use onto any machine
You may not pass copies of the eBook on to anyone else

How can I make a purchase on your website?

If you want to purchase a video course, eBook or Bundle (Print+eBook) please follow below steps:

Register on our website using your email address and the password.
Search for the title by name or ISBN using the search option.
Select the title you want to purchase.
Choose the format you wish to purchase the title in; if you order the Print Book, you get a free eBook copy of the same title.
Proceed with the checkout process (payment to be made using Credit Card, Debit Cart, or PayPal)

Where can I access support around an eBook?

If you experience a problem with using or installing Adobe Reader, the contact Adobe directly.
To view the errata for the book, see www.packtpub.com/support and view the pages for the title you have.
To view your account details or to download a new copy of the book go to www.packtpub.com/account
To contact us directly if a problem is not resolved, use www.packtpub.com/contact-us

What eBook formats do Packt support?

Our eBooks are currently available in a variety of formats such as PDF and ePubs. In the future, this may well change with trends and development in technology, but please note that our PDFs are not Adobe eBook Reader format, which has greater restrictions on security.

You will need to use Adobe Reader v9 or later in order to read Packt's PDF eBooks.

What are the benefits of eBooks?

You can get the information you need immediately
You can easily take them with you on a laptop
You can download them an unlimited number of times
You can print them out
They are copy-paste enabled
They are searchable
There is no password protection
They are lower price than print
They save resources and space

What is an eBook?

Packt eBooks are a complete electronic version of the print edition, available in PDF and ePub formats. Every piece of content down to the page numbering is the same. Because we save the costs of printing and shipping the book to you, we are able to offer eBooks at a lower cost than print editions.

When you have purchased an eBook, simply login to your account and click on the link in Your Download Area. We recommend you saving the file to your hard drive before opening it.

For optimal viewing of our eBooks, we recommend you download and install the free Adobe Reader version 9.

Hands-On Network Forensics: Investigate network attacks and find evidence using common network forensic tools

What do you get with eBook?