Chapter 4 of 5 · Cisco CCNA 200-201 CBROPS
Network Intrusion Analysis
Event sources, inspection, Wireshark, protocol headers, alert artifacts and regex.
- 7topics
- 34 minfast track
- 3diagrams and exhibits
- 20%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Event Sources and Alert OutcomesMap events to sources such as IDS, IPS, firewall, proxy, antivirus and NetFlow, and classify alerts as true or false positives…5 min
- 2Inspection Methods and Traffic CaptureCompare deep packet inspection with packet filtering and stateful firewalls, inline devices with taps and SPAN ports, and tap…Diagram5 min
- 3Wireshark and PCAP AnalysisUse Wireshark with a PCAP file to follow a TCP stream, extract transferred files, and find the addresses, ports, protocols and…5 min
- 4Protocol Headers: Ethernet, IP, TCP, UDP and ICMPRead the fields of Ethernet, IPv4, IPv6, TCP, UDP and ICMP headers and see how each field helps an analyst spot scanning…Diagram5 min
- 5Protocol Fields: DNS, Mail, HTTP and ARPInterpret DNS, SMTP, POP3, IMAP, HTTP, HTTPS, HTTP/2 and ARP fields and messages, and learn the signs of misuse that an analyst…5 min
- 6Artifact Elements in an AlertInterpret artifact elements in an alert: IP addresses, client and server ports, processes, API calls, hashes and URLs, and…Diagram5 min
- 7Basic Regular ExpressionsLearn to read basic regular expressions, including character classes, quantifiers, anchors, groups and escapes, and how analysts…4 min
About this chapter
What this chapter covers
Network Intrusion Analysis is the hands on part of the course, where you read traffic and alerts to decide what really happened.
It begins with where events come from and how to judge an alert. It then compares inspection and capture methods, and moves to working with a PCAP file in Wireshark.
The middle of the chapter covers the fields in protocol headers, because those fields are the raw facts of any capture. The chapter ends with the artifacts inside an alert and with basic regular expressions for searching logs.
How the topics fit together
The chapter follows an alert from its source, through capture and headers, to a judgement.
The first page sorts events by the technology that produced them, and names the four alert outcomes. The second page explains how the depth of inspection and the placement of a sensor decide what a tool can see.
The third page puts that to work in Wireshark, with filters, stream following and file extraction. The two header pages give the fields you meet there, first at the lower layers and then at the application layer.
The artifacts page combines network and host facts from an alert into one judgement. The final page gives you the regular expression skills to search logs for those facts.
The header pages are reference material, so return to them when a capture or log line contains a field you do not recognise.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables, diagrams and example output.
- What to remember for the exam: the facts to memorise.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
If you can, open a sample PCAP file in Wireshark while you read. Applying the filters and following a stream helps far more than reading about them.
Ready for more practice?
The full Cisco CCNA 200-201 CBROPS question bank has 754 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.