Advanced Wireshark Network Forensics - Part 1/3

Описание: If you've ever picked up a book on Wireshark or network monitoring, they almost all cover about the same information. They'll show you, "Here's an ARP frame, here's an IP packet, here's a web request..." But what they don't go into is: when you open a Pcap file for the first time, where do you start? What are the things that you look for? And how do you find them?

So my goal here is to help you bridge that gap between having a basic understanding of network protocol analyzers, and using them to solve real world problems.

Scenario pcaps:
https://github.com/NetsecExplained/Ad...