Tactical Wireshark
A Deep Dive into Intrusion Analysis, Malware Incidents, and Extraction of Forensic Evidence
- English
- ePUB (mobile friendly)
- Available on iOS & Android
Tactical Wireshark
A Deep Dive into Intrusion Analysis, Malware Incidents, and Extraction of Forensic Evidence
About this book
Take a systematic approach at identifying intrusions that range from the most basic to the most sophisticated, using Wireshark, an open source protocol analyzer. This book will show you how to effectively manipulate and monitor different conversations and perform statistical analysis of these conversations to identify the IP and TCP information of interest.
Next, you'll be walked through a review of the different methods malware uses, from inception through the spread across and compromise of a network of machines. The process from the initial "click" through intrusion, the characteristics of Command and Control (C2), and the different types of lateral movement will be detailed at the packet level.
In the final part of the book, you'll explore the network capture file and identification of data for a potential forensics extraction, including inherent capabilities for the extraction of objects such as file data and other corresponding components in support of a forensics investigation.
After completing this book, you will have a complete understanding of the process of carving files from raw PCAP data within the Wireshark tool.What You Will Learn- Use Wireshark to identify intrusions into a network
- Exercise methods to uncover network data even when it is in encrypted form
- Analyze malware Command and Control (C2) communications and identify IOCs
- Extract data in a forensically sound manner to support investigations
- Leverage capture file statistics to reconstruct network events
Frequently asked questions
- Essential is ideal for learners and professionals who enjoy exploring a wide range of subjects. Access the Essential Library with 800,000+ trusted titles and best-sellers across business, personal growth, and the humanities. Includes unlimited reading time and Standard Read Aloud voice.
- Complete: Perfect for advanced learners and researchers needing full, unrestricted access. Unlock 1.4M+ books across hundreds of subjects, including academic and specialized titles. The Complete Plan also includes advanced features like Premium Read Aloud and Research Assistant.
Please note we cannot support devices running on iOS 13 and Android 7 or earlier. Learn more about using the app.
Information
Table of contents
- Cover
- Front Matter
- 1. Customization of the Wireshark Interface
- 2. Capturing Network Traffic
- 3. Interpreting Network Protocols
- 4. Analysis of Network Attacks
- 5. Effective Network Traffic Filtering
- 6. Advanced Features of Wireshark
- 7. Scripting and Interacting with Wireshark
- 8. Basic Malware Traffic Analysis
- 9. Analyzing Encoding, Obfuscated, and ICS Malware Traffic
- 10. Dynamic Malware Network Activities
- 11. Extractions of Forensics Data with Wireshark
- 12. Network Traffic Forensics
- 13. Conclusion
- Back Matter