SECURITY 452

IP Packet Analysis

Knowing how to decode network traffic with tools is a necessary skill for any serious network or information security administrator. Being able to decode the bits and bytes that represent your mission-critical networks gives you the skills to identify malicious activity, troubleshoot network failures, and analyze other desirable or undesirable network events.

This Stay Sharp class will give you the basic skills to decode network traffic with open-source tools available for Unix and Windows systems. You'll be able to use a better understanding of your network traffic and these basic skills to analyze current or future network protocols. The tools covered in this class are: Windump/Tcpdump, Wireshark and Ngrep. The first module of this course covers a basic review of the IP and TCP headers and students are expected to be generally familiar with TCP/IP at the theoretical level. If you are not familiar with TCP/IP, we recommend you read the following documents before attending:

• http://www.sans.org/conference/tcpip_quiz.php
• http://www.sans.org/resources/tcpip.pdf

SANS never fails to provide top level training that is worth every penny.
-Tyler Hudak, Yellow Roadway Tech