EC3772 Intermediate Network Traffic Analysis (Short Course)

The Intermediate Network Traffic Analysis short course equips students with an in-depth understanding of the tools and techniques necessary for gaining deep insight into common operational requirements of DoD networks. Students will be well versed in the use of Wireshark, tshark, libpcap, and npcap. An extensive understanding of Wireshark is developed to include dissector evaluation, capture filters, display filters, and plot analysis. Through a series of case studies, students will be able to recognize the precursors of a cyber attack to allow them to take preventative measures. In the case of forensic analysis, students will be able to identify suspect traffic and make associations to identify root causes. This is a 5-day short course.

Prerequisite

EC3771 or permission of the Instructor

Lecture Hours

Lab Hours

0.5

Course Learning Outcomes

1. Demonstrate the ability to analyze mobile device traffic for malware
2. Differentiate mobile users in a collection of mobile device traffic
3. Identify suspect artificats in mobile device traffic
4. Demonstrate the ability to identify mobile application leaks
5. Define the IMEI and TAC and their significance in user differentiation
6. Recognize and analyze server side exploits in traffic
7. Explain stack depth probing and its manifestation in network traffic
8. Recognize injected and spoofed network traffic
9. Analyze artifacts of TCP session hijacking
10. Demonstrate the process of graceful resynchronization
11. Identify indicators of botnet traffic
12. Recognize and analyze new and unusual protocols associated with industrial control system traffic