Sciweavers

JDFP
2008

On Teaching TCP/IP Protocol Analysis to Computer Forensics Examiners

13 years 3 months ago
On Teaching TCP/IP Protocol Analysis to Computer Forensics Examiners
Digital investigators have an increasing need to examine data network logs and traffic, either as part of criminal or civil investigations or when responding to information security incidents. To truly understand the contents of the logs and the data packets, examiners need to have a good foundation in the protocols comprising the Transmission Control Protocol/Internet Protocol (TCP/IP) suite. This paper introduces the use of protocol analyzers and packet sniffers for TCP/IP traffic, and provides examples of normal and suspect TCP/IP traffic. This paper also provides a basis for a discussion of intrusion detection and signature analysis. Keywords TCP/IP, protocol analysis, packet sniffing
Gary C. Kessler
Added 13 Dec 2010
Updated 13 Dec 2010
Type Journal
Year 2008
Where JDFP
Authors Gary C. Kessler
Comments (0)