{"product_id":"network-forensics-9780132564717","title":"Network Forensics","description":"\u003cb\u003eBook Synopsis\u003c\/b\u003e\u003cbr\u003e\u003cp\u003e\u003cstrong\u003eSherri Davidoff\u003c\/strong\u003e is a founder of LMG Security, an information security consulting and research firm. Her specialties include network penetration testing, digital forensics, social engineering testing, and web application assessments. She holds her S.B. in Computer Science and Electrical Engineering from MIT.\u003c\/p\u003e \u003cp\u003e\u003cstrong\u003eJonathan Ham\u003c\/strong\u003e has been commissioned to teach NCIS investigators how to use Snort, performed packet analysis from a facility more than two thousand feet underground, taught intrusion analysis to the NSA, and chartered and trained the CIRT for one of the largest U.S. civilian federal agencies. He is a founder of LMG Security. His favorite field is ip[6:2].\u003c\/p\u003e\u003cbr\u003e\u003cbr\u003e\u003cb\u003eTable of Contents\u003c\/b\u003e\u003cbr\u003e\u003cp\u003e\u003cstrong\u003e\u003cem\u003eForeword xvii\u003c\/em\u003e\u003c\/strong\u003e\u003c\/p\u003e \u003cp\u003ePreface xix\u003c\/p\u003e \u003cp\u003eAcknowledgments xxv\u003c\/p\u003e \u003cp\u003eAbout the Authors xxvii\u003c\/p\u003e \u003cp\u003ePart I: Foundation 1\u003c\/p\u003e \u003cp\u003eChapter 1: Practical Investigative Strategies 3\u003c\/p\u003e \u003cp\u003e1.1 Real-World Cases 3\u003c\/p\u003e \u003cp\u003e1.2 Footprints 8\u003c\/p\u003e \u003cp\u003e1.3 Concepts in Digital Evidence 9\u003c\/p\u003e \u003cp\u003e1.4 Challenges Relating to Network Evidence 16\u003c\/p\u003e \u003cp\u003e1.5 Network Forensics Investigative Methodology (OSCAR) 17\u003c\/p\u003e \u003cp\u003e1.6 Conclusion 22\u003c\/p\u003e \u003cp\u003e\u003cstrong\u003eChapter 2: Technical Fundamentals 23\u003c\/strong\u003e\u003c\/p\u003e \u003cp\u003e2.1 Sources of Network-Based Evidence 23\u003c\/p\u003e \u003cp\u003e2.2 Principles of Internetworking 30\u003c\/p\u003e \u003cp\u003e2.3 Internet Protocol Suite 35\u003c\/p\u003e \u003cp\u003e2.4 Conclusion 44\u003c\/p\u003e \u003cp\u003e\u003cstrong\u003eChapter 3: Evidence Acquisition 45\u003c\/strong\u003e\u003c\/p\u003e \u003cp\u003e3.1 Physical Interception 46\u003c\/p\u003e \u003cp\u003e3.2 Traffic Acquisition Software 54\u003c\/p\u003e \u003cp\u003e3.3 Active Acquisition 65\u003c\/p\u003e \u003cp\u003e3.4 Conclusion 72\u003c\/p\u003e \u003cp\u003ePart II: Traffic Analysis 73\u003c\/p\u003e \u003cp\u003eChapter 4: Packet Analysis 75\u003c\/p\u003e \u003cp\u003e4.1 Protocol Analysis 76\u003c\/p\u003e \u003cp\u003e4.2 Packet Analysis 95\u003c\/p\u003e \u003cp\u003e4.3 Flow Analysis 103\u003c\/p\u003e \u003cp\u003e4.4 Higher-Layer Traffic Analysis 120\u003c\/p\u003e \u003cp\u003e4.5 Conclusion 133\u003c\/p\u003e \u003cp\u003e4.6 Case Study: Ann’s Rendezvous 135\u003c\/p\u003e \u003cp\u003e\u003cstrong\u003eChapter 5: Statistical Flow Analysis 159\u003c\/strong\u003e\u003c\/p\u003e \u003cp\u003e5.1 Process Overview 160\u003c\/p\u003e \u003cp\u003e5.2 Sensors 161\u003c\/p\u003e \u003cp\u003e5.3 Flow Record Export Protocols 166\u003c\/p\u003e \u003cp\u003e5.4 Collection and Aggregation 168\u003c\/p\u003e \u003cp\u003e5.5 Analysis 172\u003c\/p\u003e \u003cp\u003e5.6 Conclusion 183\u003c\/p\u003e \u003cp\u003e5.7 Case Study: The Curious Mr. X 184\u003c\/p\u003e \u003cp\u003e\u003cstrong\u003eChapter 6: Wireless: Network Forensics Unplugged 199\u003c\/strong\u003e\u003c\/p\u003e \u003cp\u003e6.1 The IEEE Layer 2 Protocol Series 201\u003c\/p\u003e \u003cp\u003e6.2 Wireless Access Points (WAPs) 214\u003c\/p\u003e \u003cp\u003e6.3 Wireless Traffic Capture and Analysis 219\u003c\/p\u003e \u003cp\u003e6.4 Common Attacks 224\u003c\/p\u003e \u003cp\u003e6.5 Locating Wireless Devices 229\u003c\/p\u003e \u003cp\u003e6.6 Conclusion 235\u003c\/p\u003e \u003cp\u003e6.7 Case Study: HackMe, Inc. 236\u003c\/p\u003e \u003cp\u003e\u003cstrong\u003eChapter 7: Network Intrusion Detection and Analysis 257\u003c\/strong\u003e\u003c\/p\u003e \u003cp\u003e7.1 Why Investigate NIDS\/NIPS? 258\u003c\/p\u003e \u003cp\u003e7.2 Typical NIDS\/NIPS Functionality 258\u003c\/p\u003e \u003cp\u003e7.3 Modes of Detection 261\u003c\/p\u003e \u003cp\u003e7.4 Types of NIDS\/NIPSs 262\u003c\/p\u003e \u003cp\u003e7.5 NIDS\/NIPS Evidence Acquisition 264\u003c\/p\u003e \u003cp\u003e7.6 Comprehensive Packet Logging 267\u003c\/p\u003e \u003cp\u003e7.7 Snort 268\u003c\/p\u003e \u003cp\u003e7.8 Conclusion 275\u003c\/p\u003e \u003cp\u003e7.9 Case Study: Inter0ptic Saves the Planet (Part 1 of 2) 276\u003c\/p\u003e \u003cp\u003ePart III: Network Devices and Servers 289\u003c\/p\u003e \u003cp\u003eChapter 8: Event Log Aggregation, Correlation, and Analysis 291\u003c\/p\u003e \u003cp\u003e8.1 Sources of Logs 292\u003c\/p\u003e \u003cp\u003e8.2 Network Log Architecture 306\u003c\/p\u003e \u003cp\u003e8.3 Collecting and Analyzing Evidence 311\u003c\/p\u003e \u003cp\u003e8.4 Conclusion 317\u003c\/p\u003e \u003cp\u003e8.5 Case Study: L0ne Sh4rk’s Revenge 318\u003c\/p\u003e \u003cp\u003e\u003cstrong\u003eChapter 9: Switches, Routers, and Firewalls 335\u003c\/strong\u003e\u003c\/p\u003e \u003cp\u003e9.1 Storage Media 336\u003c\/p\u003e \u003cp\u003e9.2 Switches 336\u003c\/p\u003e \u003cp\u003e9.3 Routers 340\u003c\/p\u003e \u003cp\u003e9.4 Firewalls 344\u003c\/p\u003e \u003cp\u003e9.5 Interfaces 348\u003c\/p\u003e \u003cp\u003e9.6 Logging 352\u003c\/p\u003e \u003cp\u003e9.7 Conclusion 355\u003c\/p\u003e \u003cp\u003e9.8 Case Study: Ann’s Coffee Ring 356\u003c\/p\u003e \u003cp\u003e\u003cstrong\u003eChapter 10: Web Proxies 369\u003c\/strong\u003e\u003c\/p\u003e \u003cp\u003e10.1 Why Investigate Web Proxies? 369\u003c\/p\u003e \u003cp\u003e10.2 Web Proxy Functionality 371\u003c\/p\u003e \u003cp\u003e10.3 Evidence 375\u003c\/p\u003e \u003cp\u003e10.4 Squid 377\u003c\/p\u003e \u003cp\u003e10.5 Web Proxy Analysis 381\u003c\/p\u003e \u003cp\u003e10.6 Encrypted Web Traffic 392\u003c\/p\u003e \u003cp\u003e10.7 Conclusion 401\u003c\/p\u003e \u003cp\u003e10.8 Case Study: Inter0ptic Saves the Planet (Part 2 of 2) 402\u003c\/p\u003e \u003cp\u003ePart IV: Advanced Topics 421\u003c\/p\u003e \u003cp\u003eChapter 11: Network Tunneling 423\u003c\/p\u003e \u003cp\u003e11.1 Tunneling for Functionality 423\u003c\/p\u003e \u003cp\u003e11.2 Tunneling for Confidentiality 427\u003c\/p\u003e \u003cp\u003e11.3 Covert Tunneling 430\u003c\/p\u003e \u003cp\u003e11.4 Conclusion 439\u003c\/p\u003e \u003cp\u003e11.5 Case Study: Ann Tunnels Underground 441\u003c\/p\u003e \u003cp\u003e\u003cstrong\u003eChapter 12: Malware Forensics 461\u003c\/strong\u003e\u003c\/p\u003e \u003cp\u003e12.1 Trends in Malware Evolution 462\u003c\/p\u003e \u003cp\u003e12.2 Network Behavior of Malware 484\u003c\/p\u003e \u003cp\u003e12.3 The Future of Malware and Network Forensics 491\u003c\/p\u003e \u003cp\u003e12.4 Case Study: Ann’s Aurora 492\u003c\/p\u003e \u003cp\u003e\u003cstrong\u003eAfterword 519\u003c\/strong\u003e\u003c\/p\u003e \u003cp\u003e\u003cem\u003e\u003cstrong\u003eIndex 521\u003c\/strong\u003e\u003c\/em\u003e\u003c\/p\u003e","brand":"Pearson Education (US)","offers":[{"title":"Default Title","offer_id":49396170948951,"sku":"9780132564717","price":51.29,"currency_code":"GBP","in_stock":false}],"url":"https:\/\/bookcurl.com\/products\/network-forensics-9780132564717","provider":"Book Curl","version":"1.0","type":"link"}