Network Traffic Analysis: June 8–12 | Americas & EMEA Evening


Sophisticated attackers frequently go undetected in a victim’s network for an extended period. Attackers can blend legitimate traffic with malicious network activity that only skilled network analysts know how to detect. This course shows learners how to identify malicious network activity.

The course provides an overview of network protocols, network architecture, intrusion detection systems, network traffic capture and traffic analysis. Learners review the types of network monitoring and the tools commonly used to analyze captured network traffic. The course also explores the best techniques for investigating botnets and how to use honeypots in network monitoring.

Event Information

  • LOCATION: Online
  • START DATE: June 8th, 2020 
  • END DATE: June 12th, 2020 
  • TIME: 8:00–12:00 Pacific Daylight Time, daily
    • 5:00–9:00 (Honolulu)
    • 7:00–11:00 (Anchorage)
    • 8:00–12:00 (Los Angeles/Vancouver)
    • 9:00–13:00 (Denver/Calgary)
    • 10:00–14:00 (Chicago/Mexico City/Bogotá/Lima)
    • 11:00–15:00 (New York/Toronto/Santiago)
    • 12:00–16:00 (São Paulo/Buenos Aires/Halifax)
    • 15:00–19:00 (Dakar/Accra)
    • 16:00–20:00 (London/Dublin/Lisbon/Lagos)
  • COST: US$3,000 or 4 EoD credits

Expertise On Demand (EoD) credits will be accepted

Learning Objectives

After completing this course, learners should be able to:

  • Understand the network monitoring and incident response processes, and why it’s critical in today’s network environments. Discuss the pros and cons of statistical, connection, full content and event monitoring and tools
  • Perform event-based monitoring using Snort
  • Minimize network traffic with the Snort rule structure and custom rule creation
  • Review Snort alerts using the Sguil front end

Daily Agenda

Day One

  • NTA In Incident Response
  • Networking Refresher & Linux Overview

Day Two

  • Network Packet Analysis
  • Network Sensor Deployment

Day Three

  • Netflow Analysis
  • Full Packet Capture

Day Four

  • Snort Alerts

Day Five

  • Question & Answer Session

Who Should Take This Course

Information technology and security staff, corporate investigators and other staff members who need to understand networks, network traffic, network traffic analysis and network intrusion investigations.


A basic understanding of TCP/IP and Windows and UNIX platforms. Familiarity with security terminology and a working knowledge of Wireshark is also recommended

Technical Requirements

Students will access the live instructor lecture and course labs online. Students will require a computer that meets the following minimum requirements:

  • Internet Connection: 25 Mbps+ recommended
  • Browser: Chrome recommended
  • Operating System: Windows or MacOS

Course Materials

Students will receive a lab book and access to all required class materials and tools.

Have questions?

If you have any additional questions, send us an email.

Thank you.