Overview

The first section of this course begins our bottom-up coverage of the TCP/IP protocol stack, providing a refresher or introduction, depending on your background, to TCP/IP. This is the first step in what we think of as a "Packets as a Second Language" course. Students begin to be introduced to the importance of collecting the actual packets involved in attacks and are immediately immersed in low-level packet analysis. We will cover the essential foundations such as the TCP/IP communication model, theory of bits, bytes, binary and hexadecimal, and the meaning and expected behavior of every field in the IP header. Students are introduced to the use of open-source Wireshark and tcpdump tools for traffic analysis.

We begin our exploration of the TCP/IP communication model with the study of the link layer, the IP layer, both IPv4 and IPv6, and packet fragmentation in both. We describe the layers and analyze traffic not just in theory and function, but from the perspective of an attacker and defender.

All traffic is discussed and displayed using both Wireshark and tcpdump, with the pros and cons of each tool explained and demonstrated. Students can follow along with the instructor viewing the sample traffic capture files supplied. Multiple hands-on exercises after each major topic offer you the opportunity to reinforce what you just learned.

Overview

Section 2 continues where the first section ended, completing the "Packets as a Second Language" portion of the course and laying the foundation for the much deeper discussions to come. In this section, students will gain a deep understanding of the primary transport layer protocols used in the TCP/IP model. Two essential tools, Wireshark and tcpdump, are further explored, using advanced features to give you the skills to analyze your own traffic. The focus of these tools is to filter large scale data down to traffic of interest using Wireshark display filters and tcpdump Berkeley Packet Filters. These are used in the context of our exploration of the TCP/IP transport layers covering TCP, UDP, and ICMP. Once again, we discuss the meaning and expected function of every header field, covering a number of modern innovations that have very serious implications for modern network monitoring, and we analyze traffic not just in theory and function, but from the perspective of an attacker and defender.

Once again, students can follow along with the instructor viewing the sample capture files supplied. Hands-on exercises after each major topic offer you the opportunity to reinforce what you just learned.

The bootcamp material at the end of this section moves students out of theory and begins to work through real-world application of the theory learned in the first two sections. Students learn the practical mechanics of command line data manipulation that are invaluable not only for packet analysis during an incident but also useful for many other information security and information technology roles.

Overview

Section 3 builds on the foundation of the first two sections of the course, moving into the world of application layer protocols. Students are introduced to the versatile packet crafting tool Scapy. This is a very powerful Python-based tool that allows for the manipulation, creation, reading, and writing of packets. Scapy can be used to craft packets to test the detection capability of an IDS/IPS, especially important when a new user-created IDS rule is added, for instance for a recently announced vulnerability. Various practical scenarios and uses for Scapy are provided throughout this section.

The focus of the section is on some of the most widely used, and sometimes vulnerable, crucial application protocols: DNS, HTTP(S), SMTP, and Microsoft communications. Particular attention is given to protocol analysis, a key skill in intrusion detection. Additional Wireshark capabilities are explored in the context of incident investigation and forensic reconstruction of events based on indicators in traffic data.

The course day ends with a discussion of modern IDS/IPS evasions, the bane of the analyst. Students are introduced to the theory behind these evasions, and several undocumented modern evasions are explained, along with discussion of the current detection gaps in the IDS marketplace at large. The theory and possible implications of evasions at different protocol layers are examined.

Again, students can follow along with the instructor viewing the sample traffic capture files supplied. Four hands-on exercises, one after each major topic, offer students the opportunity to reinforce what they just learned.

The end of section 3 again moves students from the realm of theory to practical application. Students continue in a guided exploration of real-world network data, applying the skills and knowledge learned over the first three sections of the course to an investigation of the data that will be used in the final capstone challenge.

Overview

The fundamental knowledge gained from the first three sections provides the foundation for deep discussions of modern network intrusion detection systems during section 4. Everything that students have learned so far is now synthesized and applied to designing optimized detection rules for Snort/Firepower, and this is extended even further with behavioral detection using Zeek (formerly known as Bro).

We begin with a discussion on network architecture, including the features of intrusion detection and prevention devices, along with a discussion about options and requirements for devices that can sniff and capture the traffic for inspection. This section provides an overview of deployment options and considerations, and allows students to explore specific deployment considerations that might apply to their respective organizations.

The remainder of the section is broken into two main parts. The first covers the most commonly used approach, signature-based detection using Snort or Firepower. The second is an introduction to Zeek, followed by a shift to constructing anomaly-based behavioral detection capabilities using Zeek's scripting language and cluster-based approach. One student who was already running Zeek (or Bro) prior to class commented that, "after seeing this section of the class, I now understand why [Zeek] matters; this is a real game changer."

After covering basic proficiency in the use of Zeek, the instructor will lead students through a practical threat analysis process that is used as the basis for an extremely powerful correlation script to identify any potential phishing activity within a defended network. Further practical examples are provided to students, demonstrating how this approach to behavioral analysis and correlation can close the enormous gap in relying solely on signature-based detection tools.

This section has less formal instruction and longer hands-on exercises to encourage students to become more comfortable with a less guided and more independent approach to analysis. This is intended to simulate the environment of an actual incident investigation that you may encounter at your sites. Hands-on exercises, one after each major topic, offer you the opportunity to reinforce what you just learned.

The material at the end of this section once again moves students out of theory and into practical use in real-world situations. Students continue to expand their understanding of the developing incident under analysis in preparation for the final capstone by applying all of the techniques learned so far.

Overview

The fifth section continues the trend of less formal instruction and more practical application in hands-on exercises. It consists of three major topics, beginning with practical network forensics and an exploration of data-driven monitoring vs. alert-driven monitoring, followed by a hands-on scenario that requires students to use all of the skills developed so far. The second topic continues the theme of data-driven analysis by introducing large-scale analysis and collection using NetFlow and IPFIX data. Following a discussion of the powerful correlations and conclusions that can be drawn using the network metadata, students will work on a second guided scenario that leverages this set of tools, in addition to other skills learned throughout the week. The section concludes with a detailed discussion of practical TLS analysis and interception and more general command and control trends and detection/analysis approaches. A third scenario is provided for students to work on after class.