SECURITY 452

IP Packet Analysis

Knowing how to decode network traffic is a skill requirement for any serious network or information security administrator. Being able to decode the bits and bytes that represent our mission-critical networks will give you the skills to identify malicious activity, troubleshoot network failures, and analyze other desirable or undesirable network events. This Stay Sharp class will give you the skills necessary to decode network traffic with open-source tools available for Unix and Windows systems. You'll be able to adapt these skills to meet the demanding requirements of your network, giving you a fundamental skill in analyzing current or future network protocols. The tools covered in this class are: Windump/Tcpdump, Ethereal and Ngrep. Students are expected to be generally familiar with TCP/IP at the theoretical level. If you are not familiar with TCP/IP, we recommend you read the following documents before attending:

**http://www.sans.org/conference/tcpip_quiz.php **http://www.sans.org/resources/tcpip.pdf

Just amazing content and instruction, it's really a 'must do' for any info sec professional.
-Mark Austin, PHH Mortgage