Cyber Security SOC Analyst - Network Attacks from Scratch

Learn how network packets carry data between devices and how to read them in binary and hexadecimal; examine packet fields, decoding tips, and Windows event logs for SOC investigations.

Identify the MAC address as a 48-bit physical address of six bytes used on local network, and explain the IP address as a logical identifier with private and public ranges.

Explore how network address translation (NAT) uses the gateway to map private IP addresses to public IP addresses, enabling devices like smartphones and workstations to access the internet.

Explore port address translation (pat) and how the gateway maps port information and public ip addresses to identify and forward requests based on source ports.

Learn how Wireshark and Tshark capture and analyze network packets, view frames, and filter traffic with display and capture filters to focus on source and destination IPs, ports, and protocols.

Explore the internet layer and the IP header, including how packets travel between source and destination. Understand that IP does not guarantee delivery and review the IP packet's fields.

This lecture describes IP header fields and the IP packet, detailing how the header guides routing from source to destination on the internet, with options up to 60 bytes.

Explore the transport layer and tcp header, contrast with udp's unreliability, and understand client-server packet delivery and how connections are initiated.

Analyze transport layer headers, including source and destination ports, sequence and acknowledgment numbers, flags, window size, checksum, and the three-way handshake that establishes a TCP connection.

Explore transport layer attacks such as IP spoofing, bandwidth abuse, and fragmentation, and use stateful firewalls and IDS to detect and block them.

Analyze the UDP protocol and its header, showing how UDP sends datagrams without a connection or delivery confirmation, and how port numbers govern this lightweight communication.

Explore the UDP header fields, including source port, destination port, and checksum, and understand how the checksum verifies data integrity during transport layer delivery.

Explain how ICMP echo requests and replies verify connectivity, describe the common ICMP types and their type and code fields, and show how ping reveals network reachability.

Explore icmp-based attacks such as discovery and fingerprinting, and how attackers map networks with udp probes and traceroute. Learn defender strategies to block outbound icmp/udp and patch vulnerable systems.

Discover how protocols govern network communication and how ports serve as endpoints. Explore common port numbers like 67 and 68 and the roles of TCP, UDP, IP, and ICMP.

Learn how the ARP protocol maps IP addresses to MAC addresses on a local network, using a broadcast request to discover the destination's MAC and populate the source's ARP cache.

Explore the client-server model, where a client accesses a service offered by servers on specific ports, and how multiple independent servers provide services.

Explore the http protocol fundamentals, including port 80, plaintext risks, and encryption. Learn how get and post requests and status codes (200, 304, 3xx, 4xx, 5xx) drive web communication.

Learn how the domain name system translates domain names to IP addresses on port 53 using UDP or TCP, with caching and resolver queries.

Cover the basics of ftp, telnet, ssh, and smtp, including how email clients connect and transfer data, and the risks of plaintext communications in network protocols.

Explore how DNS zone transfer attacks reveal a network's IP addresses and domain names, and apply remediation by blocking suspicious IP addresses and securing DNS transfers.

Understand host discovery attack techniques and practical remediation, including blocking suspect packets, filtering traffic at the firewall, and monitoring for malicious activity to protect network devices.

Learn how port scanning reveals open ports on hosts by probing IPs, distinguishing open, closed, and filtered responses, and implement remediation with monitoring and firewall blocking.

Identify software and design weaknesses through vulnerability scanning, analyze application-layer signatures and alerts, correlate multiple detections, and remediate by blocking malicious IPs with firewall controls.

Explore arp poisoning and mitm concepts, and demonstrate how malicious mac and ip cache updates misdirect traffic through a switch, enabling man-in-the-middle attacks and remediation strategies.

Explore how dos and ddos attacks overwhelm services via botnets and amplification techniques like dns amplification and udp floods, and learn remediation through packet captures and traffic blocking.