Traffic Analysis for Intrusion Prevention

Name: Traffic Analysis for Intrusion Prevention
Author: Jerry Smith

Learn how to perform a deeper analysis of traffic throughout your network to implement more specific security measures

Preview the first lesson free — get full access to all 3 lessons.

Course: On-Demand

Hello. My name is Jerry Smith, and in. This lesson we're going to have an introduction to the TCP, IP and OSI models. Let's check it out. Anyone interested in the technology field in. Particular if you're doing any sort of sysadmin networking. And of course, cyber needs to have. An understanding of the OSI and TCPIP models. In most discussions you will see the OSI I. OSI stands for Open Systems Interconnection Model, used to explain traffic flow and how to describe issues such as the issue was a layer three problem. The OSI model is theoretical in that. It is used to visualize how networking. Occurs, but it isn't actually implemented. It was adopted by the ISO, the. International Organization for Standardization in 1984. Let's take a look at a portion of the standard. Here you can see in bullet one. Six that the intent of this standard was meant to be very broad, in. That it is a reference model used. To explain communications between computer systems, not necessarily a practical application that is to be implemented. Now let's check out the model. When visualizing traffic flow, it's important to. Know a few things. When traffic is leaving a machine, it. Flows down, and when it enters a machine, it flows upwards. Traffic does not have to originate nor. Terminate at the highest layer, but it cannot skip layers. For instance, traffic can flow from network through data link to physical and then. Back up, but it cannot skip from network to physical. The OSI is numbered from seven to one, with seven being application and one being physical. Let's look at each layer. Layer one is the physical layer, and. It'S just that it's where the machine is physically communicating across the network. That could be in the form of. Electrical signals, over ethernet light via fiber optic or radio waves via WiFi. Layer two is the data link layer. It's where Mac addresses and basic switching occurs. The traffic here is in the form of frames. Layer three is where your router lives, and IP addressing is here. Layer four is the transport layer. TCP UDP. That's transmission control protocol and user datagram protocol lives here. This is also where you find logical ports. Layer five is session. This layer maintains connections between machines. Layer six is the presentation layer. Here you'll find encryption. Layer seven is the application layer. This is where you interact with the machine. Chrome, Firefox, et cetera, live here. In terms of on the job, it. Seems like layers one through four are. The most often discussed. To memorize the OSI model, there are. Two popular mnemonics that will help you remember. The first letter of each layer from. Bottom to top is Please do not. Throw sausage pizza away from the top. Down and not quite as relevant of. A reference is all people seem to need data processing. Now let's take a look at the TCP IP model. TCP is Transmission Control Protocol and IP is Internet Protocol. The TCP IP model was developed by the IETF. That's Internet Engineering Task force in 1981. Actually predating the OSI model. This is the original standard, and here. You can see the rudimentary four layer model. What I find most notable is the line that references the Internet datagram. It states that it offers a method for providing addresses on multiple networks that set the stage for a model of. Internet traffic that is still in use. Today over 40 years later. Here's the model. Notice it only has four layers, but let's look at each one. Layer one is Network Access and it. Handles physical access, Mac addresses, and basic switching. It matches up to OSI layers one and two. Layer two is Internet and is responsible. For routing and IP addresses and matches. Up to the OSI at layer three. Layer three is Transport, handles Ports and. It matches up to OSI layer four. Layer four is Application and handles everything dealing with software. And as you can see, it matches. Up to OSI layers five through seven. Let's look at the models side by side. Here you can see how they match up. By understanding these models, you can troubleshoot. Issues much more quickly, and as a. Bonus, they make great interview questions. Stay tuned for the next lesson where. We will have an introduction to the TCP Dump application. Thanks for watching. If.

Beginner Provider : Jerry Smith 3 Lessons · 14m in Arabic, German, English, Spanish, French, Portuguese, Chinese

Course Description

To effectively protect and secure a network, one must understand what it is they are protecting. To implement and maintain Intrusion Detection and Prevention Systems, an analyst must fully understand how network traffic flows, which is why this course will introduce the OSI and TCP/IP models and explain how networks communicate with one another. When performing an investigation or troubleshooting an issue, it’s important to remember that more information is always better. Using network analysis tools such as tcpdump and Wireshark will give you a unique and detailed view of your network traffic.

In this course on Traffic Analysis for Intrusion Prevention, we will explore the OSI and TCP/IP network models to get a granular view of how network traffic works. We will also explain how to install and use tcpdump and Wireshark. By the end of this course, you will have the skills needed to better analyze and monitor network traffic and security.

What You'll Learn

Understand the importance of the OSI and TCP/IP network models and how networks communicate
Explore how network traffic flows at a granular level to support intrusion detection and prevention
Install and use tcpdump to capture and view network traffic
Install and use Wireshark to analyze network traffic in detail
Apply best practices for monitoring network traffic and security

Key Takeaways

Understanding what you are protecting and how network traffic flows is essential to implementing and maintaining Intrusion Detection and Prevention Systems.
The OSI and TCP/IP models provide a granular view of how networks communicate with one another.
Network analysis tools such as tcpdump and Wireshark give a detailed view of network traffic.
When investigating or troubleshooting, more information is always better.
By the end of the course, learners gain the skills to better analyze and monitor network traffic and security.

Frequently Asked Questions

Who is this course for?

It is for analysts who work to protect and secure a network and who need to implement and maintain Intrusion Detection and Prevention Systems by understanding how network traffic flows.

What tools does this course cover?

It covers the network analysis tools tcpdump and Wireshark, explaining how to install and use each to view network traffic in detail.

What topics are taught in this course?

The course introduces the OSI and TCP/IP network models and explains how to install and use tcpdump and Wireshark, with lessons on Introduction to TCP/IP and OSI, Introduction to TCP Dump, and Introduction to Wireshark.

What skills will I gain?

You will gain skills in intrusion detection and prevention, network protocol analysis, network traffic analysis, network traffic management, packet analyzer use, and traffic analysis, enabling you to better analyze and monitor network traffic and security.