Network Forensics

Content: Cover
 Title Page
 Copyright
 About the Author
 About the Technical Editor
 Credits
 Contents
 Introduction
 What This Book Covers
 How to Use This Book
 How This Book Is Organized
 Chapter 1: Introduction to Network Forensics
 What Is Forensics?
 Handling Evidence
 Cryptographic Hashes
 Chain of Custody
 Incident Response
 The Need for Network Forensic Practitioners
 Summary
 References
 Chapter 2: Networking Basics
 Protocols
 Open Systems Interconnection (OSI) Model
 TCP/IP Protocol Suite
 Protocol Data Units
 Request for Comments
 Internet Registries
 Internet Protocol and Addressing Internet Protocol AddressesInternet Control Message Protocol (ICMP)
 Internet Protocol Version 6 (IPv6)
 Transmission Control Protocol (TCP)
 Connection-Oriented Transport
 User Datagram Protocol (UDP)
 Connectionless Transport
 Ports
 Domain Name System
 Support Protocols (DHCP)
 Support Protocols (ARP)
 Summary
 References
 Chapter 3: Host-Side Artifacts
 Services
 Connections
 Tools
 netstat
 nbstat
 ifconfig/ipconfig
 Sysinternals
 ntop
 Task Manager/Resource Monitor
 ARP
 /proc Filesystem
 Summary
 Chapter 4: Packet Capture and Analysis
 Capturing Packets
 Tcpdump/Tshark
 Wireshark
 Taps Port SpanningARP Spoofing
 Passive Scanning
 Packet Analysis with Wireshark
 Packet Decoding
 Filtering
 Statistics
 Following Streams
 Gathering Files
 Network Miner
 Summary
 Chapter 5: Attack Types
 Denial of Service Attacks
 SYN Floods
 Malformed Packets
 UDP Floods
 Amplification Attacks
 Distributed Attacks
 Backscatter
 Vulnerability Exploits
 Insider Threats
 Evasion
 Application Attacks
 Summary
 Chapter 6: Location Awareness
 Time Zones
 Using whois
 Traceroute
 Geolocation
 Location-Based Services
 WiFi Positioning
 Summary
 Chapter 7: Preparing for Attacks
 NetFlow
 Logging SyslogWindows Event Logs
 Firewall Logs
 Router and Switch Logs
 Log Servers and Monitors
 Antivirus
 Incident Response Preparation
 Google Rapid Response
 Commercial Offerings
 Security Information and Event Management
 Summary
 Chapter 8: Intrusion Detection Systems
 Detection Styles
 Signature-Based
 Heuristic
 Host-Based versus Network-Based
 Snort
 Suricata and Sagan
 Bro
 Tripwire
 OSSEC
 Architecture
 Alerting
 Summary
 Chapter 9: Using Firewall and Application Logs
 Syslog
 Centralized Logging
 Reading Log Messages
 LogWatch
 Event Viewer
 Querying Event Logs
 Clearing Event Logs Firewall LogsProxy Logs
 Web Application Firewall Logs
 Common Log Format
 Summary
 Chapter 10: Correlating Attacks
 Time Synchronization
 Time Zones
 Network Time Protocol
 Packet Capture Times
 Log Aggregation and Management
 Windows Event Forwarding
 Syslog
 Log Management Offerings
 Timelines
 Plaso
 PacketTotal
 Wireshark
 Security Information and Event Management
 Summary
 Chapter 11: Network Scanning
 Port Scanning
 Operating System Analysis
 Scripts
 Banner Grabbing
 Ping Sweeps
 Vulnerability Scanning
 Port Knocking
 Tunneling
 Passive Data Gathering
 Summary