Wireshark for Forensics

- Basics of IT forensics: Definition and meaning of IT forensics; application areas and scenarios; legal framework - A brief introduction to Wireshark: History and development of Wireshark; basic functions and user interface; installation and setup - Network analysis with Wireshark: basics: creating and using profiles and Geo IP; expanding capture and display filters; analyzing network protocols - Advanced network analysis and forensics: Identification and analysis of security incidents; logging and documentation; practical exercise: complex scenarios and forensic investigations - Use of external tools in IT forensics: Introduction to other relevant tools (e.g. tcpdump, pktmon, ...); integration of these tools in Wireshark and Network Miner; case studies: Using tcpdump and pktmon for packet capture, using Network Miner to extract artifacts, using other tools to detect attack patterns - Case studies and exercises with practical examples and in-depth analysis - Presentation and analysis of real case studies: Verification of DDoS attacks; investigation of a data leak; detection and analysis of malware communication; forensic analysis of an insider attack; network forensics in botnet implementation; detection of Trojans in the network; investigation of network traffic in case of suspicious user behavior - Discussion and analysis of the techniques used - Experience reports and lessons learned