Network Forensics
Network Forensics
Network Forensics
Information and Whitepapers
Download or Read On-Line
(For Your Knowledge or Curiosity)
Network Forensics - Netcat-Ncat
Network Forensics - Web
Network Forensics - Sniffers and Sniffing
Network Forensics - Packet Analysis
Network Forensics - Packet Crafting and Packet Injection
-
Network Intrusion Detection - Evasion, Traffic Normalization and Semantics (Classic) by Mark Handley, Vern Paxson, and Christian Kreibich

-
Insertion, Evasion, and Denial of Service - Eluding Network Intrusion Detection (Classic) by Thomas H Ptacek, and Timothy N Newsham

-
Attacking WiFi with Traffic Injection by Cedric Blancher

-
Packet Craft by Mike Poor

-
Packet Testing Tools by Dan Dirks

-
An Introduction to the Tool Loki by Burning Asgard

-
Crafting Routing Protocols Using Nemesis by MattA

-
Fun with Packets by Coretez Giovanni

-
Generation and Validation of Emperically Derived TCP by Felix Hernandez-Campos

-
Getting Started with Hping3 by unknown

-
Harpoon Manual by Joel Sommers

-
How To Test an ISP by Renaud Bidou

-
Hping Man Page by Salvatore Sanfilippo

-
Hping Tutorial by Philippe Bogaerts

-
Hping2 Basics by Chris Gates

-
Hping2 HOWTO by Salvatore Sanfilippo

-
Introduction to Protocol Fuzzing Using Scapy by Artjom Vassiljev

-
Metasploit 3 Developers Guide by The Metasploit Staff

-
Metasploit Framework User Guide Version 3.1 by The Metasploit Staff

-
Metasploit Framework User Guide Version 3.2 by The Metasploit Staff

-
Metasploit Meterpreter by Scape

-
Network Packet Forgery with Scapy by Philippe Biondi

-
Next Hop by David G. Andersen

-
On Interactive Internet Traffic Replay by Seung-Sun Hong and S. Felix Wu

-
Packet Analysis Tools and Methodology by Don Parker

-
Packet Crafting for Firewall and IDS Audits by Don Parker

-
Network Packet Forgery with Scapy by Philippe Biondi

-
Packet Crafting via Hping by alt_don

-
Packet Trace Manipulation Framework for Test Labs by Andy Rupp, Holger Dreger, Anja Feldmann, and Robin Sommer

-
Packet Wizardry Ruling the Network with Python by Rob klein Gunnewiek

-
Performance Evaluation of Packet Capturing Systems for High-speed Networks by Fabian Schneider

-
pktd - A Packet Capture and Injection Daemon by Jose Marıa Gonzalezi and Vern Paxson

-
Precision and Accuracy of Network Traffic by Marcos Paredes-Farrera, Martin Fleury and Mohammed Ghanbari

-
Scapy Documentation by Philippe Biondi

-
Self Configuring Network Traffic Generation by Joel Sommers and Paul Barford

-
Simple Metaspoit in Action by Cyberheb

-
Testing IDS Rulesets with Hping by Alt.don

-
The Hping2 Idle Host Scan by Erik J. Kamerling

-
The Nemesis Project by Mark Grimes and Jeff Nathan

-
Tools of the Trade by Don Parker

-
Using Hping by Salvatore Sanfilippo

-
Wifi Advanced Stealth by Laurent Butti and Franck Veysset

-
Writing Exploits with the Metasploit Framework by unknown

-
Writing Metasploit Plugins by Saumil Shah

Network Forensics - Reconnaissance - NMAP
Network Forensics - Reconnaissance - Nessus
Network Forensics - Reconnaissance - Scanning
Network Forensics - Reconnaissance - Fingerprinting
Network Forensics - Penetration
Network Forensics - Ethernet and Data Link Layer (Layer 2)
Network Forensics - VLAN (Virtual LANS)
Network Forensics - UPoE (Universal Power Over Ethernet)
Network Forensics - Powerline Ethernet
Network Forensics - Routers-Routing-Switching - Switching
Network Forensics - Routers-Routing-Switching - Routing
Network Forensics - Routers-Routing-Switching - Routing Protocols
Network Forensics - Routers-Routing-Switching - GRE (Generic Routing Encapsulation)
Network Forensics - Routers-Routing-Switching - Cisco
Network Forensics - Routers-Routing-Switching - Michael J. Martin Papers
Network Forensics - IP Addressing, Subnetting, CIDR (Classless Inter-Domain Routing), and Routing
Network Forensics - IP - AS (Autonomous System) Numbers
Network Forensics - IP - QoS (Quality of Service)
Network Forensics - IP - IP Fragmenation and PMTU Discovery
Network Forensics - IP - IP Spoofing
Network Forensics - IP - NAT (Network Address Translation)
Network Forensics - IPv6
Network Forensics - TCP/IP
-
End To End Internet Packet Dynamics by Vern Paxson

-
Insertion, Evasion and Denial of Service: Eluding Network Intrusion Detection (Classic) by Ptacet and Newsham

-
Understanding Internet Traffic Streams by Nevil Borwnlee and kc claffy

-
Network Intrusion Detection Evasion, Traffic Normalization and Semantics (Classic) by Handley, Paxson and Keibich

-
Payload Anatomy and Future Mutations by Riley Hassell

-
Probing TCP Implementations by Douglas E. Comer and John C. Lin

-
A Simple Active Attack Against TCP by Laurent Joncheray

-
SYN Floods and SYN Cookies by NeonSurge

-
TCP/IP Gender Changer by Ivan Buetler

-
Slipping in the Window: TCP Reset Attacks by Paul A. Watson

-
Inferring and Visualizing Social Networks On IRC by Paul Mutton

-
Windows 2000 TCP-IP Implementation Details by Dave MacDonald and Warren Barkley (Microsoft Corporation)

-
Windows 2003 TCP-IP Implementation Details (Microsoft Corporation)

-
TCP-IP Fundamentals for Microsoft Windows (Microsoft Corporation)

-
Windows NT TCP-IP by Dave MacDonald

-
Explicit Congestion Notification (ECN) for TCP-IP by Joseph Davies

-
TCP and Explicit Congestion Notification by Sally Floyd

-
Inferring Internet DOS Activity by David Moore, Geoffery M. Voelker, and Stefan Savage

-
Network Analysis Technology for Microsoft Visibility by Michiharu Arimoto

-
TCP State by Gary C. Kessler

-
Scaring Crackers Away with TCP Wrapper by Adam Olson

-
TCP-IP Protocol Suite by Mark E. Donaldson

-
TCP-IP Troubleshooting (Microsoft Corporation)

-
TCP-IP Tutorial and Technical Overview by Adolpho Rodriquez, Hohn Gatrell, John Karas, and Roland Peschke

-
The Problem with Random Increments by Timothy M. Newsham

-
Unicast Reverse Path Forwarding (Cisco Systems)

-
Windows TCP-IP Fundamentals by Joseph Davies

-
Observed Structure of Addresses In IP Traffic by Eddie Kohler, Jinyang Li, Vern Paxson, and Scott Shenker

-
Session Layer by Mitch Neilsen

-
Daryl's TCP-IP Primer by Daryl Banttari

-
Windows 95 TCP-IP (Microsoft Corporation)

-
Windows 2000 TCP-IP (Microsoft Corporation)

-
Windows 2003 TCP-IP Technical Reference (Microsoft Corporation)

-
TCP-IP Checksums by Alex Urich

Network Forensics - TCP/IP - OSI Model
Network Forensics - TCP/IP - Covert Channels
Network Forensics - TCP/IP and Network Programming
Network Forensics - SCTP (Stream Control Transmission Protocol) and MPLS (Multiprotocol Label Switching)
Network Forensics - IGMP (Internet Group Management Protocol)
Network Forensics - ICMP (internet Control Messaging Protocol)
-
ICMP Attacks Against TCP by F. Gont

-
ICMP Usage in Scanning Version 1.0 (Classic) by Ofir Arkin

-
ICMP Usage in Scanning Version 2.01 (Classic) by Ofir Arkin

-
ICMP Usage in Scanning Version 2.5 (Classic) by Ofir Arkin

-
ICMP Usage in Scanning Version 3.0 (Classic) by Ofir Arkin

-
ICMP Protocol by Mark E. Donaldson

-
Ping and How It Works by Mark E. Donaldson

-
The Storey of the PING Program by Mike Muuss

-
NT Ping by Mark E. Donaldson

-
ICMP Applications (EventHelix)

-
ICMP Packet Filtering by Mark E. Donaldson

-
Ping Tunnel by Daniel Stodle

-
Using ICMP Tunneling to Steal Internet by doug

-
A Remote Active OS Fingerprinting Tool Using ICMP by Ofir Arkin

-
ICMP Based Remote OS TCP-IP Stack Fingerprinting Techniques (Phrack Classic) by Ofir Arkin and Fyodor Yarochkin

-
X - Remote ICMP OS Fingerprinting Techniques by Ofir Arkin and Fyodor Yarochkin

-
XProbe - Remote ICMP Based OS Fingerprinting Techniques by Ofir Arkin

-
Xprobe2 - A Fuzzy Approach to Remote Active Operating System Fingerprinting by Ofir Arkin and Fyodor Yarochkin

-
XPobe2 by Ofir Arkin

-
XProbe++ Presentation by Ofir Arkin, Fyodor Yarochkin, Meder Kydyraliev, Shih-Yao Dai, Yennun Huang, and Sy-Yen Kuo

-
Xprobe2++ by Ofir Arkin, Fyodor Yarochkin, Meder Kydyraliev, Shih-Yao Dai, Yennun Huang, and Sy-Yen Kuon

-
XProbe2-Rev1.0 by Ofir Arkin

-
XProbe2-Rev1.5 by Ofir Arkin

Network Forensics - ARP (Address Resolution Protocol) and RARP (Reverse
Address Resolution Protocol)
Network Forensics - RPC and DCOM
Network Forensics - SMTP (Simple Mail Transfer Protocol) - Mail Protocols
Network Forensics - SMTP - Email Forensics
Network Forensics - SMTP - Mail Administration
Network Forensics - SMTP - Mail Security
Network Forensics - SMTP - MTA (Mail Transport Agents) - Sendmail
Network Forensics - SMTP - MTA (Mail Transport Agents) - Postfix
Network Forensics - SMTP - MTA (Mail Transport Agents) - Exim
Network Forensics - SMTP - MTA (Mail Transport Agents) - Qmail and Zmailer
Network Forensics - SMTP - MDA (Mail Delivery Agents) - Procmail
Network Forensics - SMTP - MUA (Mail User Agents)
Network Forensics - SMTP - SPAM Control
Network Forensics - SMTP - SPF (Sender Policy Framework) - Email Validation
Network Forensics - NNTP (Network News Transport Protocol)
Network Forensics - DNS
Network Forensics - DNS - BIND (Berkeley Internet Named Daemon)
Network Forensics - DNS - Windows DNS
Network Forensics - DNS - IPv6
Network Forensics - DHCP (Dynamic Host Configuration Protocol)
Network Forensics - NTP (Network Time Protocol) and SNTP (Simple Network Time Protocol)
Network Forensics - IDENT (Identification) and AUTH (Authorization)
Network Forensics - Telnet
Network Forensics - FTP
Network Forensics - TFTP
Network Forensics - HTTP
Network Forensics - SNMP
Network Forensics - PXE (Pre-Boot Execution Environment
Network Forensics - RFB (Remote Framebuffer) and RDP (Remote Desktop Protocol)
Network Forensics - VPN
Network Forensics - VPN - IPsec
Network Forensics - VPN - SSL (Secure Sockets Layer) and TLS (Transport
Layer Security)
Network Forensics - VPN - SSH
Network Forensics - Honeypots
Network Forensics - Honeypots - Know Your Enemy Series (KYE)
Network Forensics - MPLS and SCTP
Network Forensics - Bandwidth-Connectivity-Troubleshooting
Network Forensics - VoIP
Network Forensics - VoIP - RTP (Real Time Transport Protocol) and RTSP (Real Time Streaming Protocol)
Network Forensics - VoIP - SIP
Network Forensics - VoIP - H323 and H248
Network Forensics - UPnP (Universal Plug and Play)
Network Forensics - LDAP (Lightweight Directory Access Protocol)
Network Forensics - CIFS (Common Internet File System)
Network Forensics - CIFS - Samba
Network Forensics - CIFS - Microsoft Historical (Hard to Find Classics)
Network Forensics - NFS (Network File System) and NIS (Network Information Service
Network Forensics - Dfs (Distributed File System)
Network Forensics - Storage Networks (NAS and SAN)
Network Forensics - Authentication
Network Forensics - Authentication - Kerberos, RADIUS (Remote Authentication Dial In User Service), and TACACS (Terminal Access Controller Access Control System)
Network Forensics - Authentication - PAM (Plugable Authentication Modules)
Network Forensics - Authentication - Microsoft
Network Forensics - SCADA (Supervisory Control and Data Acquisition)
Network Forensics - Monitoring
Network Forensics - Automation and Convergence - Cfengine
Whitepapers from SecurityFocus.com
Technical Books