Network Analysis and Forensics Notes

This guide is the definitive Network analysis Notes collection, condensing over 130 pages of protocol dissections, traffic patterns, and forensic methodologies into one lethal manual.

Unlike generic networking textbooks that bore you with abstract theory, this guide is a hands-on field manual for the modern analyst.

It bridges the gap between knowing what a TCP handshake is and actually spotting a SYN flood attack in a live stream.

Whether you are a SysAdmin troubleshooting a slow server or a SOC analyst hunting for C2 beacons, this book provides the structured clarity and command-line precision you need to turn raw data into actionable intelligence.

Wireshark Notes: From Display Filters to Decryption

Wireshark is the industry standard, but most people only scratch the surface of its capabilities. These Wireshark notes turn you into a power user by moving beyond simple IP filtering.

The guide provides a deep dive into advanced Display Filters, teaching you how to use logical operators and regex matches to isolate specific HTTP methods, spot anomalies in window sizes, or track down specific error codes like http.response.code == 503.

Crucially, it demystifies the dark art of Decryption, providing step-by-step workflows for decrypting SSL/TLS traffic using CLIENT_RANDOM secrets and unlocking encrypted SMB3 sessions to extract transferred files.

You will also learn how to use the Statistics and Conversations menus to rapidly identify top talkers and resolve addresses, ensuring you don't waste hours scrolling through noise when the answer is in the metadata.

Network Forensics Notes: Tshark, Zeek, & Brim

Real network forensics often happens on the command line, and this guide refuses to let you hide behind a GUI. It includes extensive Network forensics notes on using Tshark, the command-line version of Wireshark, to parse massive PCAP files that would crash a standard desktop interface.

You will find specific one-liners for extracting DNS queries, filtering specific protocol fields, and generating statistical summaries on the fly. Furthermore, the book expands your arsenal with Zeek (formerly Bro) and Brim, teaching you how to analyze log files for deeper threat hunting.

It explains how to use Zeek scripts to extract artifacts like DHCP hostnames and how to use Brim's query language to correlate connections and visualize traffic flows, effectively giving you a "god mode" view of your network's history.

Protocol Analysis & Attack Detection

You cannot defend a network if you don't understand the protocols that power it. These Network analysis Notes provide a rigorous breakdown of core protocols like HTTP, DNS, DHCP, and ARP, explaining not just how they work, but how they break.

The guide details how to spot specific attacks, such as ARP Spoofing by detecting duplicate address frames, and TCP Connect/SYN Scans by analyzing flag combinations and window sizes. It even covers ICMP Tunneling detection by analyzing payload lengths and DNS Exfiltration by spotting anomalously long query names.

This section is essential for anyone who wants to move beyond "alert fatigue" and actually understand the mechanics of the attacks triggering their SIEM.