Description: This packet capture crash course will provide students with the foundations for performing packet capture, traffic analysis, and the implementation of a NMS (Network Monitoring [System|Sensor]). Students of all levels of skill can gain from this workshop. These potential gains include operating system concepts, practical command-line usage and tools, increased knowledge of Linux networking, and TCP/IP stacks. Libpcap packet capture files (pcaps) will be distributed and analyzed by students. We will peruse malicious traffic (exploits, botnets, virii), bad users, loud users etc. Full-content data, session data, and statistical data will be touch upon. Students who wish to follow along should bring a laptop with a Linux distribution. I recommend having the following tools installed: tcpdump, iftop, tcpstat, netsniff-ng (compile it), ntop, tcpdstat, hping, nmap, speedometer, tcpflow, tcpick, snort, httpry, passivedns, ngrep, nfex, foremost, arpwatch, argus, vnstat, sar, mpstat, htop We'll do as many things as we have time for. Or, just bring a VM of Security Onion.
Tags: securitytube , hacking , hackers , information security , convention , computer security , hackercon-3 ,
Disclaimer: We are a infosec video aggregator and this video is linked from an external website. The original author may be different from the user re-posting/linking it here. Please do not assume the authors to be same without verifying.