This video demonstrates how Splunk works as a network traffic evidence acquisition tool.
- [Lecturer] Before analyzing network data with Splunk, … in this case raw network traffic, … let's take a moment to capture the data first. … Open Wireshark, … type … sudo … space … wireshark … press Enter … provide the password, press Enter again … click on the capture button, … let it run for a while and let's save the traffic … as a tcpdump pcap file. … Stop capturing, go to File, … choose Save as … use sample as your file name, … select … tcpdump … pcap … and save. … Now, we are ready to analyze the traffic in Splunk. … As you can see, Splunk is a web application. … We need an app called PCAP Analyzer for Splunk … but you don't see it here, so let's find it … by clicking on Find More Apps. … Type pcap in the searchbox, … press Enter, … PCAP Analyzer for Splunk shows up, … click on Install, … type your username and password, … click on Login and Install, … and then we will restart Splunk. … Now let's go back in … by clicking on Sign in. … Note that there are also many other apps available …
- Goals of network forensics
- Using a syslog and Microsoft Log Parser
- Investigating network traffic
- How protocol analysis works
- ARP and DNS poisoning
- Working with network forensics tools
- Using packet sniffers
Skill Level Intermediate
Learning Cryptography and Network Securitywith Lisa Bock1h 45m Intermediate
Insights from a Cybersecurity Professionalwith Mike Chapple32m 15s Intermediate
What you should know2m 11s
1. Understanding Network Forensics
2. Preparing for a Network Forensics Investigation
3. Investigating Network Events
4. Investigating Network Traffic
5. Network Forensics Tools
Next steps1m 15s
- Mark as unwatched
- Mark all as unwatched
Are you sure you want to mark all the videos in this course as unwatched?
This will not affect your course history, your reports, or your certificates of completion for this course.Cancel
Take notes with your new membership!
Type in the entry box, then click Enter to save your note.
1:30Press on any video thumbnail to jump immediately to the timecode shown.
Notes are saved with you account but can also be exported as plain text, MS Word, PDF, Google Doc, or Evernote.