CNFE: Certified Network Forensics Examiner

Home > Course Catalog > Choose By Topics > Cybersecurity > CNFE: Certified Network Forensics Examiner

$3,495

Contact for Group Training

Course Overview

The Certified Network Forensics Examiner was originally developed for a U.S. classified government agency. The CNFE takes a digital and network forensic skill set to the next level by navigating through over twenty modules of network forensic topics.

The CNFE provides practical experience through our lab exercises that simulate real-world scenarios which cover investigation and recovery of data in network, Physical Interception, Traffic Acquisition, Analysis, Wireless Attacks and SNORT. The Cybersecurity Training Course focuses on the centralizing and investigating of logging systems as well as network devices.

Schedule

Start Date	Delivery Format	Days	Time	Status	Price	Enroll
Coming Soon	Live Virtual Led	5	10:00 am	Enrolling Now	$3,495	CNFE: Certified Network Forensics Examiner quantity
Coming Soon	Live Virtual Led	5	10:00 am	Enrolling Now	$3,495	CNFE: Certified Network Forensics Examiner quantity

Looking for Corporate/Group Training?

Leave us a message

Who Should Attend

The primary target audience for the course is as follows:

Students preparing to take the CCNP Collaboration certification
Network administrators
Network engineers
Systems engineers

Prerequisites

2 years of networking experience
2 years of IT Security
Working Knowledge of TCPIP

Objectives

Upon completion, students will:

Have knowledge to perform network forensic examinations.
Have knowledge to accurately report on their findings from examinations
Be ready to sit for the CNFE Exam

Course Outline

Module 1 -Digital Evidence Concepts

Overview
Concepts in Digital Evidence
Section Summary
Module Summary

Module 2 -Network Evidence Challenges

Overview
Challenges Relating to Network Evidence
Section Summary
Module Summary

Module 3 – Network Forensics Investigative Methodology

Overview
OSCAR Methodology
Section Summary
Module Summary

Module 4 – Network-Based Evidence

Overview
Sources of Network-Based Evidence
Section Summary
Module Summary

Module 5 – Network Principles

Background
History
Functionality
FIGURE 5-1 The OSI Model
Functionality
Encapsulation/De-encapsulation
FIGURE 5-2 OSI Model Encapsulation
Encapsulation/De-encapsulation
FIGURE 5-3 OSI Model peer layer logical channels
Encapsulation/De-encapsulation
FIGURE 5-4 OSI Model data names
Section Summary
Module Summary

Module 6 – Internet Protocol Suite

Overview
Internet Protocol Suite
Section Summary
Module Summary

Module 7 – Physical Interception

Physical Interception
Section Summary
Module Summary

Module 8 – Traffic Acquisition Software

Agenda
Libpcap and WinPcap
LIBPCAP
WINPCAP
Section Summary
BPF Language
Section Summary
TCPDUMP
Section Summary
WIRESHARK
Section Summary
TSHARK
Section Summary
Module Summary

Module 9 – Live Acquisition

Agenda
Common Interfaces
Section Summary
Inspection Without Access
Section Summary
Strategy
Section Summary
Module Summary

Module 10 – Analysis

Agenda
Protocol Analysis
Section Summary
Section 02
Packet Analysis
Section Summary
Section 03
Flow Analysis
Protocol Analysis
Section Summary
Section 04
Higher-Layer Traffic Analysis
Section Summary
Module Summary

Module 11 – Layer 2 Protocol

Agenda
The IEEE Layer 2 Protocol Series
Section Summary
Module Summary

Module 12- Wireless Access Points

Agenda
Wireless Access Points (WAPs)
Section Summary
Module Summary

Module 13 – Wireless Capture Traffic and Analysis

Agenda
Wireless Traffic Capture and Analysis
Section Summary
Module Summary

Module 14 – Wireless Attacks

Agenda
Common Attacks
Section Summary
Module Summary

Module 15 – NIDS_Snort

Agenda
Investigating NIDS/NIPS
and Functionality
Section Summary
NIDS/NIPS Evidence Acquisition
Section Summary
Comprehensive Packet Logging
Section Summary
Snort
Section Summary
Module Summary

Module 16 – Centralized Logging and Syslog

Agenda
Sources of Logs
Section Summary
Network Log Architecture
Section Summary
Collecting and Analyzing Evidence
Section Summary
Module Summary

Module 17 – Investigating Network Devices

Agenda
Storage Media
Section Summary
Switches
Section Summary
Routers
Section Summary
Firewalls
Section Summary
Module Summary

Module 18 – Web Proxies and Encryption

Agenda
Web Proxy Functionality
Section Summary
Web Proxy Evidence
Section Summary
Web Proxy Analysis
Section Summary
Encrypted Web Traffic
Section Summary
Module Summary

Module 19 – Network Tunneling

Agenda
Tunneling for Functionality
Section Summary
Tunneling for Confidentiality
Section Summary
Covert Tunneling
Section Summary
Module Summary

Module 20 – Malware Forensics

Trends in Malware Evolution
Section Summary
Module Summary

HANDS-ON LABORATORY EXERCISES

Lab 1 – Working with captured files

Exercise 1 – HTTP.pcap
Exercise 2 – SMB.pcap
Exercise 3 – SIP_RTP.pcap>

Lab 2 Layer 2 Attacks

Exercise 1 Analyze the capture of macof.
Exercise 2 Manipulating the STP root bridge election process

Lab 2 – Active Evidence Acquisition

Lab 3 – Preparing for Packet Inspection

Lab 4 – Analyzing Packet Captures

Exercise 2: Analyze TKIP and CCMP Frames starting from 4-Way Handshake process.

Lab 5 – Case Study: ABC Real Estate

Lab 6 – NIDS/NIPS

Exercise 1 – Use Snort as Packet Sniffer
Exercise 2 – Use Snort as a packet logger
Exercise 3 – Check Snorts IDS abilities with pre-captured attack pattern files

Lab 7 – Syslog Exercise

Lab 8 – Network Device Log

LAB 9 – SSL

Exercise 1- Decrypting SSL Traffic by using a given Certificate Private Key
Exercise 2 SSL and Friendly Man-in-the-middle

Click here to view course outline Close