• Network Forensics
  • Network Forensics Blogs
  • Network Forensics and Wireshark on Twitter
  • Network Forensics Tools
    • WireEdit
    • Wireshark
      • Wireshark online learning
      • Laura Chappell
      • Sharkfest
      • Wireshark Slides
    • Fiddler
    • Transum wireshark plugin
    • Manuales de Wireshark
    • Wireshark 2.0
    • Network Forensics and Monitoring for MySQL and PostgreSQL
  • DPI Deep Packet Inspection
    • CapAnalysis

Network Forensics¶

Network Forensics Blogs¶

• wireshark.org
• sharkfest.wireshark.org
• wiresharktraining.com
• packetbomb.com
• blog.packet-foo.com
• LoveMyTool - Building an Open Community for Network Management and Monitoring
• thevisiblenetwork.com
• packetlife.net
• Packet Pushers
• The Networking Nerd
• sharkfest.wireshark.org
• seguridadyredes.wordpress.com

Network Forensics and Wireshark on Twitter¶

• twitter.com/LauraChappell
• twitter.com/WiresharkNews
• twitter.com/wiresharktweets
• twitter.com/wiresharku
• twitter.com/seguridadyredes
• twitter.com/packetbomb
• twitter.com/PacketJay
• twitter.com/packetlife
• twitter.com/packetpushers
• twitter.com/networkingnerd
• twitter.com/SharkFest_2016
• twitter.com/NetBeez
• twitter.com/Securactivepv

Network Forensics Tools¶

• Digital Attack Map. Top daily DDoS attacks worldwide 🌟🌟🌟
  • radware.com: DDoS Handbook

WireEdit¶

• WireEdit. First-Of-A-Kind and The Only Full Stack WYSIWYG Packet Editor Edit L2 - L7 with just a few clicks

Wireshark¶

• Optimal Wireshark Setup | Enhance Your Wireshark Experience
  • Switches And Tool Placement (by Tony Fortunato). Ubicación de las herramientas de análisis de tráfico en redes conmutadas (switched networks). Taps, span ports y hubs
• Wireshark 101: Transmission Control Protocol, video tutorial
• Tip: do not capture on a computer directly unless you understand the side effects and you can live with them.

  Do not capture on local systems. Use SPAN ports and TAPs, if you have to. It’s the only way to get good readings. Unless you don’t care about frame sizes, timings, broken checksums, interference from other software you should not capture on a local system.

• HTTP Basic Authentication with wireshark
• youtube: TCP Window Performance Analysis
• How Can the Packet Size Be Greater than the MTU?
• INE.com training videos: Analyzing Packet Lengths
• blog.cloudflare.com - The story of one latency spike
  • packetbomb.com: Case Study: All Web Pages Load Slooooowly 🌟🌟
  • Calculate HTTP response time in wireshark
  • Diagnose slow connections with Wireshark
  • Toubleshooting with Wireshark: Detect HTTP Delays
  • Troubleshooting with Wireshark: Detect TCP Delays (full video)
  • Packet timing and Average IO Graph with Wireshark
  • Calculate HTTP response time in wireshark
  • Understanding Application Performance on the Network – Part VII: TCP Window Size
• Troubleshooting with Wireshark: Identifying SIP Errors
  • How to Capture and Debug SIP Packets from asterisk using tcpdump and Wireshark
• Julia Evans: tcpdump is amazing 🌟🌟🌟
• tecmint: 12 Tcpdump Commands – A Network Sniffer Tool
• Ten Powerful Wireshark Filters 🌟🌟🌟

i finally figured out that tcpdump is amazing. here's some of what I learned: https://t.co/OxqKocS3p3

— Julia Evans (@b0rk) 17 de marzo de 2016

tcpdump is a command-line packets sniffer or package analyzer tool...https://t.co/ECkBftFsaX #Linux #networking pic.twitter.com/U31fQ1iC3c

— TecMint.com (@tecmint) 15 de mayo de 2016

our star: the packet! pic.twitter.com/bwRaObb4ko

— Julia Evans (@b0rk) 23 de diciembre de 2016

anatomy of a packet pic.twitter.com/ZeLU8IJ6GR

— Julia Evans (@b0rk) 26 de noviembre de 2016

Wireshark online learning¶

• Udemy.com: Wireshark Crash Course
• Lynda.com: Troubleshooting Your Network with Wireshark

Laura Chappell¶

• Laura Chappell's Top Videos
  • Wireshark Tip 10: Identify Separate TCP Conversations with TCP Stream Index (Laura Chappell)
  • Wireshark profiles
  • PacketLife.net
  • Sharkfest 2013 - Wireshark Network Forensics (Laura Chappell). Seguridad con Wireshark: ejemplos de ataques de seguridad DDoS (macof, DNS), filtros, perfiles, coloreado de frames y tshark para trazas largas
  • wireshark's colors, by Laura Chappell

Sharkfest¶

• Sharkfest '14 Retrospective
  • How to Use Wireshark to Analyze Video
  • Sharkfest '14 presentation: Get started with HTTP Analysis
  • Tuning Win7 Using Wireshark’s TCP Stream Graph
• One way to prevent DDoS attacks similar to macof is by blocking connections (SYN) going through the firewall with MSS=0 and WinSize=0.
  • Flood network with random MAC addresses with macof tool
  • 'itsoknoproblembro' Toolkit - The Beast that Beat Banks
  • HTCIA | High Technology Crime Investigation Association

Wireshark Slides¶

Fiddler¶

• Fiddler is an HTTP debugging proxy server that complements Firefox or Chrome devtools (F12 key)
  • Fiddler, un proxy para depurar aplicaciones
  • slideshare: Debugging with Fiddler

Transum wireshark plugin¶

• TRANSUM Wireshark Plugin. Some Wireshark dissectors provide response time measurement values, but what gets measured is not ideal for performance analysis work
  • Wireshark Transum Quickstart (by Tony Fortunato)

Manuales de Wireshark¶

• Manual básico de wireshark
• Analisis de red mediante Wireshark y Tcpdump
• Protocolo dns analizado con wireshark

Learn to write #Wireshark dissectors at #SharkFest16 https://t.co/krDz2SPD0R

— Laura Chappell (@LauraChappell) 3 de marzo de 2016

A Deep Dive Into DNS Packet Sizes: Why Smaller Packet Sizes Keep The Internet Safe https://t.co/9a8duqMk5j #networking #security #sysadmin

— nixCraft (@nixcraft) 4 de marzo de 2016

Wireshark 2.0¶

• Wireshark 2.0 Follow TCP Stream (by Tony Fortunato)

Network Forensics and Monitoring for MySQL and PostgreSQL¶

• VividCortex
• Announcing VividCortex's Free Network Analyzer Tools for MySQL and PostgreSQL
• Analyzing PostgreSQL Network Traffic with vc-pgsql-sniffer
• Wireshark Profile for Databases

DPI Deep Packet Inspection¶

• Deep Packet Inspection

CapAnalysis¶

• CapAnalysis