When Netflow meets Pcap - A network forensic approach.#

Peter

• Why: The central tradeoff of network forensics — netflow scales but drops payload, pcap keeps payload but doesn't — addressed by merging the two; useful for anyone holding large-scale network telemetry.
• What: A workshop introducing an approach that merges netflow and pcap data: using the nfdump toolset to prepare and process large pcaps, enriching netflow with third-party information (geolocation, Tor), and searching for network artifacts, with hands-on real-data exercises. (from abstract only)
• How: Netflow theory and usage, an nfdump primer, large-pcap processing, enrichment, and artifact hunting.
• Where applicable: General network forensics / IR workflows; workshop format requiring basic Linux and command-line skills.