🎯 What You'll Learn
- Capture traffic correctly
- Dissect common protocols
- Detect link-layer attacks
- Investigate suspicious flows
About This Workbook
This workbook covers traffic analysis end to end: capturing cleanly, dissecting protocols, and recognising the link-layer and application anomalies that signal an attack.
Chapter 1 — Capturing Cleanly
Getting the data you need without noise.
- Capture points
- Filters
- Storage
Chapter 2 — Protocol Dissection
Understanding what the packets mean.
- Common protocols
- Following streams
- Extracting artefacts
Chapter 3 — Detecting Attacks
Spotting malicious patterns in traffic.
- ARP and link-layer anomalies
- Rogue devices
- Exfiltration patterns
Keep going. Work through each chapter in order, then apply what you learned in the matching labs.