Network Forensics and Attack Analysis Using Wireshark

In this hands-on lab, you'll step into the role of a network administrator facing a range of cyber threats. Suspicious TCP flags, abnormal DNS activity, and brute-force attacks are just a few of the signs you'll investigate. Using Wireshark as your primary tool, you'll capture and analyze traffic to detect Christmas Tree scans, decrypt TLS sessions using SSL key logs, identify botnet-related behavior, and examine multiple attack vectors including SYN floods, ICMP floods, MAC flooding, and ARP poisoning. You'll also use tools like tshark, hping3, macof, Hydra, and Metasploit to simulate attacks, while exploring how NetworkMiner can supplement Wireshark in forensic analysis. This lab is ideal for anyone pursuing skills in network forensics, penetration testing, or incident response.